homedir-polyfill

Build provenancecaution

No build attestation or trusted-publisher provenance is present, limiting publication transparency. This is a moderate hygiene gap rather than evidence that the release is unsafe.

Maintainerscaution

Only one registry publishing account is listed. The matching repository owner provides continuity, but the project still has a thin publishing base and limited redundancy.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single maintainer is not supported by visible organizational backing.

Release historycaution

The package has had no release in over seven years, with only four releases overall and none in the last 12 months. Its stable 1.0.3 version reduces churn, but the long silence raises abandonment concerns.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, consistent with the long release gap and indicating little current maintenance capacity.