is-set

Build provenancecaution

No build attestation or trusted-publisher record is present, leaving publication provenance less transparent. This is a transparency gap, not evidence that the release is unsafe on its own.

Lifecycle scriptscaution

A prepublish lifecycle script is present. This is a modest publishing-process concern, but it is not an install-time runtime dependency or evidence of abandonment by itself.

Release historycaution

The package has existed since 2015 but has only five releases, with no releases in the last 12 months and the latest release more than two years ago. That slow cadence may be acceptable for a small stable utility, but it limits evidence of active release maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the slow release history, this is the clearest evidence of limited current maintenance.

Repo issue activitycaution

There is one open issue and no recent issue or pull-request activity. This is consistent with a mature small package, though it provides little evidence of active support.