lowdb

Build provenancecaution

No build attestation or trusted-publisher identity is present, reducing release transparency, though this is a provenance gap rather than evidence of unsafe behavior by itself.

Maintainerscaution

Only one registry account has publish access, which limits publishing redundancy; the linked repository and project ownership provide some compensation but not a broad maintainer base.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer does not benefit from visible organizational backing.

Release historycaution

The package has a long history and 76 releases, but its latest registry release was in December 2023 with no releases in the last 12 months, indicating slowed maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing the concern that active development has slowed.