internal-ip

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, leaving the connection between source and published artifact less independently verifiable.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer does not have organizational backing to offset a thin maintainer base.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months, which is a maintenance concern, although the recent release and repository push provide compensating evidence.

Repo toolingcaution

No build tool or security scanning tool was detected. This is a transparency and hygiene gap, though the package is small and its repository is directly linked.

Workflow auditcaution

The sole workflow was fully analyzed with no injection or high-confidence dangerous findings, but both of its two action references are unpinned, weakening reproducibility and update safety.