hastscript

Build provenancecaution

No build attestation or trusted-publisher provenance is available. That leaves publication origin less transparent, although the package has a matching maintained repository and release notes.

Release historycaution

The package has existed for about 10 years with 22 releases, but it has had no registry release in the last 12 months. That is a meaningful maintenance concern, though the linked repository was pushed recently.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. The recent repository push is reassuring, but the current activity level still suggests slower maintenance.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security-scanning tools were detected. This is a modest repository hygiene gap rather than evidence of abandonment.

Workflow auditcaution

Both workflows were analyzed successfully and no audit findings or untrusted checkouts were reported. However, all four action references are unpinned, leaving avoidable update and supply-chain hygiene risk.