jpeg-js

Release historycaution

The package has 21 releases since 2014, but no registry release in over four years. That long release gap is a meaningful maintenance concern for a dependency, even with the repository still present.

Repo commit activitycaution

There were no commits and no active maintainers in the measured three-month period. This indicates currently slow source development, although the recent repository push prevents treating it as clearly abandoned.

Repo toolingcaution

No build tools or security scanning tools were detected. This is a hygiene gap, but the small pure-JavaScript package and its test suite partly reduce the concern.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and maintenance expectations.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings or untrusted triggers, but both action references are unpinned. That leaves a modest workflow reproducibility and supply-chain hygiene gap.