iterall

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is recorded. This is a supply-chain transparency gap, though it is less serious than an unsafe release workflow on its own.

Maintainerscaution

Only one registry account has publish access. This is a thin publishing base and leaves limited redundancy if that maintainer stops supporting releases.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single maintainer represents the project's actual visible ownership and does not benefit from organization backing.

Release historycaution

The package has 13 releases since June 2016, but none in the last six years; the latest registry release was in January 2020. This is a meaningful maintenance concern for a dependency that may need future compatibility fixes.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with an inactive project and increasing abandonment risk.