is-stream

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable than it could be. This is a transparency gap, not evidence that the release is unsafe.

Release historycaution

The project is mature, with releases since 2015, but it has had no registry release in the last 12 months and its median release interval is about 449 days. That is a modest maintenance concern for a stable utility.

Repo commit activitycaution

There were no commits from active maintainers in the last three months. Combined with the infrequent release history, this indicates quiet maintenance, although the package is small and stable.

Repo toolingcaution

The repository reports no build tool or security-scanning tool. For this small package that is a modest hygiene gap rather than a severe maturity concern.

Workflow auditcaution

The single workflow was fully analyzed with no reported audit findings or untrusted checkout and script-injection paths. Both of its two action references are unpinned, which is a minor reproducibility and supply-chain hygiene concern.