has-flag

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable. This is a transparency weakness, but it is partly offset by the matching repository and clear package structure.

Release historycaution

The package has six releases over about 11 years, with the latest release on July 19, 2021 and no releases in the last 12 months. This is a meaningful maintenance concern, although the small, focused package may not require frequent releases.

Repo commit activitycaution

The repository had 0 commits and 0 active maintainers in the last 3 months, consistent with the long gap since the latest release. That weakens evidence of ongoing maintenance and increases abandonment risk.

Token permissionscaution

The workflow does not declare top-level token permissions, so its permissions are less explicit than ideal. No top-level write permissions were observed, limiting the severity of this hygiene concern.