marky

Build provenancecaution

No build attestation or trusted-publisher setup was observed, reducing publication transparency, though this is a hygiene concern rather than evidence that the release is unsafe.

Maintainerscaution

Only one registry account has publish access. This is a modest continuity risk for an individually owned package, although repository activity and matching ownership provide some context.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing signal to offset the thin publisher base.

Release historycaution

The package has existed since 2016 with 12 releases, but its latest release was about 17 months ago and it had no releases in the last 12 months, indicating a slow or paused release cadence.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last 3 months, weakening evidence of active maintenance despite the more recent push timestamp.