kapsule

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less verifiable than it could be.

Lifecycle scriptscaution

A prepare install-time script is present. No evidence shows that it is harmful, but it adds build-time behavior beyond ordinary file consumption.

Maintainerscaution

Only one account has registry publish access. That is a limited publishing base, and the low recent repository activity provides no strong compensating evidence of active redundancy.

Release historycaution

The package has 50 releases and a historically short median interval of about 4.7 days, but its latest release was about 19 months ago and there were no releases in the last 12 months.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last 3 months, reinforcing the long release gap and indicating currently limited maintenance activity.