infima

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent. This is a moderate transparency gap, not evidence that the release is unsafe.

Release historycaution

The package has 46 releases and historically released about every 19 days, but it has had no release in over two years. That long release gap lowers confidence in continued maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful recent-maintenance gap, although the recent push and merged pull requests provide some counterevidence.

Repo toolingcaution

The project uses npm scripts for builds but reports no security-scanning tools, leaving repository security automation limited.

Version stabilitycaution

The assessed version is a prerelease, and all recent releases are prereleases, so API or behavior changes may be more likely than for a stable release.