just-diff-apply

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable.

Release historycaution

The package has 18 releases since August 2017, but none in the last 12 months and the latest release was in December 2022, indicating prolonged release inactivity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful sign of limited current maintenance.

Repo toolingcaution

The repository uses TypeScript, npm scripts, and Rollup, but no security scanning tools were detected; this is a modest transparency and hygiene gap.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers or audit findings, but both of its two action references are unpinned, weakening build reproducibility.