json-schema-typed

Build provenancecaution

The release has no provenance attestation or trusted-publisher identity, so consumers have less evidence connecting the artifact to its source build.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the two-account registry maintainer list offers only a small visible ownership base.

Release historycaution

The package is mature at about seven years old, but it has only one release in the last 12 months and the latest release was about 10 months ago, indicating a slow cadence.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, a meaningful warning about current maintenance capacity despite the recent release push.

Repo toolingcaution

The repository reports no build tools and no security scanning tools, leaving build and security practices less visible than they could be.