jsprim

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers cannot independently verify how this release was produced. This is a transparency weakness, though not severe by itself.

Release historycaution

The package has 29 releases and a historically regular median interval of about 43 days, but its latest release was nearly 5 years ago and there were no releases in the last 12 months. This materially raises abandonment risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last 3 months, consistent with the long release gap. The repository is not archived, but current maintenance activity is absent.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, with three open issues and one open pull request. This supports the picture of a quiet, slowly maintained project.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and response expectations undocumented.