is-jpg

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This weakens publication transparency, but it is a moderate gap rather than evidence that the package is unfit.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no demonstrated organizational backing to offset the thin maintenance evidence.

Release historycaution

The package has seven releases over about 12 years, but none in the last five years. This is a meaningful maintenance concern, though the small, focused package may need few changes.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old registry release, this supports a cautionary maintenance assessment.

Repo toolingcaution

No build tool or security scanning tool was detected. The package is simple and has no runtime dependencies, so this is a transparency gap rather than a severe adoption risk.