jsonpath

Repo commit activitydanger

There were zero commits and zero active maintainers in the last three months. Although releases continue, the absence of observed development activity is a material abandonment-risk signal.

Build provenancecaution

The release has no build attestation, trusted publisher, or staged publishing evidence. This weakens release transparency, though it is a hygiene concern rather than proof of unsafe behavior.

Dependency profilecaution

Three runtime dependencies are declared, including static-eval, so the package has meaningful transitive maintenance exposure. The dependency count is moderate rather than excessive.

Maintainerscaution

Only one registry account has publish access, leaving a thin publishing base. The repository is user-owned rather than organization-backed, so no provided signal compensates for this concentration.

Project backingcaution

The repository is owned by the individual account dchester, not an organization, and no registry namespace is provided. This offers limited evidence of organizational continuity behind the package.