hash-base

Build provenancecaution

No build attestation or trusted-publisher metadata is present. That limits publication transparency, though it is not evidence that the release is unsafe.

Lifecycle scriptscaution

A prepack lifecycle script is present, adding build-time publishing complexity. Because it is prepack rather than an install-time script, the consumer-side risk is limited.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. The recent release and push date partly compensate, but current maintenance activity is still thin.

Repo toolingcaution

The repository reports no build tool and no security-scanning tool. For a small JavaScript package this is a hygiene gap, but it is not a severe health risk on its own.

Security policycaution

The repository has no security policy. This reduces transparency for reporting vulnerabilities, although the package remains documented and maintained within an organization-owned project.