is-weakset

Build provenancecaution

No build attestation or trusted-publisher identity is present, so consumers have less evidence connecting the published artifact to its source build.

Lifecycle scriptscaution

The package uses prepack and prepublish scripts. These are build and publication hooks rather than install-time execution, but they add some release-process complexity.

Maintainerscaution

Only one registry account has publish access, creating a thin publishing base. The organization-backed repository provides some compensation, but it does not remove the single-publisher concentration.

Release historycaution

The package has existed for about 11.6 years with seven releases, but has had no release in the last 12 months and typically waits about 505 days between releases. That is a maintenance-cadence concern for a dependency.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. The recent repository push is reassuring, but the current short-term activity remains limited.