locate-app

Build provenancecaution

The release has no build attestation, trusted publisher identity, or staged publishing. This weakens publication transparency, but the package still has a visible matching repository and license.

Maintainerscaution

Only one registry account can publish the package. The linked repository is user-owned rather than organization-backed, so there is limited visible publishing redundancy.

Release historycaution

The package has 84 releases over roughly five years, but none in the last 12 months; its latest release was nearly two years ago. This suggests maintenance has stopped despite a previously active cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing the release gap and increasing abandonment risk.

Security policycaution

The repository has no security policy, leaving no documented process for reporting and handling vulnerabilities. This is a transparency gap, though it is not evidence of a security incident.