is

Build provenancecaution

No build provenance attestation or trusted-publisher identity is present, leaving publication origin less independently verifiable.

Lifecycle scriptscaution

A prepublish lifecycle script runs during publishing. This is not evidence of an unsafe install hook, but it adds publishing complexity compared with a package without lifecycle scripts.

Maintainerscaution

Only one registry account has publish access. The linked repository is user-owned rather than organization-backed, so the narrow publishing base provides limited redundancy.

Project backingcaution

The source repository is owned by an individual account rather than an organization, so there is no observed organizational backing to offset the narrow maintainer base.

Release historycaution

The package has a long history and 34 releases, but it had no release in the last 12 months; that weakens evidence of active maintenance despite its recent latest release.