hasha

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent, although this is not by itself evidence of an unsafe release.

Maintainerscaution

One registry publisher account is listed, but the linked repository is maintained under the same individual account, so the registry concentration is consistent with the project structure.

Release historycaution

The package is mature, with 17 releases over more than 11 years, but it has had no registry release in the last 12 months. The recent repository push partly offsets the slow release cadence.

Repo bus factorcaution

All recent commits came from one contributor, creating a concentrated maintenance dependency. The repository is user-owned rather than organization-owned, so no organizational handoff evidence offsets this.

Repo commit activitycaution

One commit from one active maintainer in the last three months shows some maintenance, but the very small recent activity footprint limits evidence of sustained support.