lsofi

Build provenancecaution

No build attestation or trusted-publisher configuration was observed, limiting release transparency. This is a provenance gap rather than evidence that the release is malicious.

Maintainerscaution

One registry maintainer is consistent with the linked repository being owned by an individual, but it leaves the package dependent on a narrow publishing base.

Project backingcaution

The repository is owned by an individual rather than an organization, providing less institutional continuity than organization-backed projects.

Release historycaution

The package is mature at about 10 years old, but it has only two releases with a median interval of about 9.5 years; one release in the last 12 months provides some recent activity without showing a regular cadence.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. That recent inactivity is a meaningful maintenance concern despite the recent package release.