gud

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence was found. For this small JavaScript artifact this is a transparency gap, though it is not by itself evidence that the package is unsafe to adopt.

Release historycaution

This is a single-release package first published over eight years ago, with no releases in the last 12 months. That may be acceptable for a tiny stable utility, but it provides little evidence of ongoing maintenance.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months, consistent with the long-stalled release history and increasing abandonment risk.

Security policycaution

The repository has no security policy. This limits disclosure and maintenance transparency, particularly because the package explicitly warns that its identifiers are not suitable for security-sensitive use.