is-function

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers receive limited evidence about how the release was published. This is a transparency gap rather than evidence of maliciousness.

Maintainerscaution

Only one registry account has publish access, leaving a thin publishing base. The package is small, but there is no provided evidence of a broader maintainer bench.

Release historycaution

The latest release was about 6 years ago, with no releases in the last 12 months. The package is small and mature, but the long silence raises abandonment risk.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last 3 months. Combined with the old latest release, this supports a maintenance concern.

Repo toolingcaution

The repository uses no build tooling or security scanning. For this tiny dependency that is mainly a hygiene gap, but it provides little automated protection.