karma-coverage-istanbul-reporter

Release historydanger

The package has 32 releases and historically released about every 15 days, but it has had no release in more than six years. That long pause materially raises abandonment risk.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months. Combined with no registry release since May 2020, this indicates weak current maintenance.

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This reduces publication transparency, but it is a supply-chain hygiene gap rather than proof that the release is unsafe.

Maintainerscaution

Only one account has registry publish access, which creates a thin publishing base. The linked repository is also user-owned, so there is no organization backing shown to compensate for that concentration.

Repo toolingcaution

The repository uses build tooling, but no security-scanning tools were detected. This is a modest transparency and maintenance gap, not a standalone severe risk.