json-logic-js

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, so registry provenance is less transparent even though this is not by itself evidence of an unhealthy package.

Maintainerscaution

Only one registry account has publish access. That is a thin publishing base for a user-owned project and leaves limited redundancy if the maintainer becomes unavailable.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single maintainer is not offset by visible organizational backing.

Release historycaution

The package has 19 releases over more than 10 years, but no release in the last two years; this suggests maintenance has stopped or slowed substantially.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the broader absence of recent release activity and raising abandonment concern.