human-signals

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable than it could be.

Maintainerscaution

Only one registry account has publish access. That is a thin publishing base and increases continuity risk if the maintainer becomes unavailable.

Release historycaution

The project has existed since 2019 with 16 releases, but it had no releases in the last 12 months and its latest release was in March 2025, indicating a long release gap.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, reinforcing the concern that maintenance activity has slowed substantially.

Repo toolingcaution

The repository uses TypeScript and Gulp, but no security-scanning tools were detected, leaving a modest security-process gap.