matcher-collection

Lifecycle scriptscaution

A prepare lifecycle script runs during installation or packaging, which adds some supply-chain and reproducibility surface, although this signal alone does not show a dangerous action.

Maintainerscaution

Only one registry account has publish access, creating a limited publishing capacity and a higher single-person continuity risk, though the repository is owned by the same individual.

Project backingcaution

The source repository is owned by an individual rather than an organization, so the single-maintainer limitation is not offset by visible organizational backing.

Release historycaution

The package has 11 releases since 2015, but its latest release was in October 2019 and it had no releases in the last 12 months, indicating a long period without published updates.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and indicating little current maintenance capacity.