is-decimal

Build provenancecaution

No build provenance attestation or trusted-publisher configuration was detected, so consumers cannot verify how the published artifact was produced. This is a transparency gap, not a standalone disqualifier.

Release historycaution

The package has had no registry release since November 2021, with zero releases in the last 12 months. That long gap materially raises maintenance and abandonment concerns for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although the package is small and stable, there is no recent evidence of ongoing maintenance.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security-scanning tools were detected. The build setup is a modest positive, while the missing scanning lowers transparency somewhat.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. This is a hygiene gap rather than evidence that the package is unsafe.