htmlescape

Build provenancecaution

No build attestation or trusted-publisher identity is present, reducing publication transparency. This is a supply-chain hygiene gap rather than evidence that the release is unsafe.

Maintainerscaution

Only one registry account has publish access. That is a limited publishing base and creates resilience concerns if the maintainer becomes unavailable, with no organizational backing shown.

Release historycaution

The package has four releases since September 2014, with the latest published in March 2016 and none in the past 12 months. This is a meaningful maintenance concern, though the small, stable scope may reduce the need for frequent releases.

Repo commit activitycaution

There were zero commits and zero active maintainers in the past three months. The repository's last push was in 2022, so current maintenance capacity appears limited.

Repo toolingcaution

The repository uses no build tool and has no detected security-scanning tools. The simple six-file JavaScript package keeps the build gap modest, but security visibility is limited.