is-inside-container

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers have less evidence connecting the published artifact to its source. This is a transparency gap rather than a health verdict by itself.

Maintainerscaution

A single registry maintainer is a narrow publishing base, although the linked repository identifies the same owner and the package is directly backed by that project.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational continuity signal to offset the narrow maintainer base.

Release historycaution

There has been only one release, and no releases in the last 12 months; the latest release is nearly three years old. This may be acceptable for a small utility, but it leaves little evidence of ongoing release maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and indicating little current maintenance capacity.