js-sdsl

Build provenancecaution

No build attestation or trusted publisher identity is provided, leaving the relationship between source and published artifact less independently verifiable.

Lifecycle scriptscaution

A prepare install-time script is present. This is a modest supply-chain and installation-complexity concern, though the signal does not show malicious behavior or excessive scripting.

Release historycaution

The package has 49 releases over roughly 4 years, but the latest registry release was more than two years ago and there were no releases in the last 12 months, indicating possible maintenance slowdown.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is direct evidence of currently limited development activity.

Security policycaution

No repository security policy was found, reducing clarity about vulnerability reporting and response expectations.