json-cycle

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot independently verify how the registry artifact was produced. This is a modest supply-chain transparency gap rather than a severe risk on its own.

Release historycaution

The latest release was published in April 2023, and there were no releases during the following 12 months, indicating a long period without updates. Its 11-release history and mature stable version partly offset the concern.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months, consistent with the release history showing no recent development. The repository is still present and not archived, but current maintenance activity is absent.

Security policycaution

The repository has no security policy, leaving no documented channel or process for reporting vulnerabilities. This is a transparency gap, though it does not by itself show that the package is unsafe.