http-status

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, so consumers cannot independently verify how this release was produced.

Lifecycle scriptscaution

A prepare script runs during installation, adding install-time behavior and some review burden, although this signal alone does not show that the script is unsafe.

Release historycaution

The project has 42 releases over more than 15 years, but the latest registry release was about 20 months ago and there were no releases in the last 12 months. This suggests slowing maintenance despite its long history.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent push date and mature project history do not compensate for this current inactivity enough to remove the maintenance concern.

Repo toolingcaution

The project uses TypeScript, tsup, and npm scripts for reproducible building, but no security-scanning tools were detected. The build setup is sound while security-process visibility is limited.