math-intrinsics

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is recorded. This weakens release transparency, though it is not by itself evidence that the package is unsafe.

Dangerous workflowscaution

Two workflows use pull_request_target, which requires careful review because it runs with elevated repository context. No untrusted checkout or script-injection patterns were detected, which limits the concern.

Release historycaution

Only two releases have been published, and the latest was about 21 months ago. That may be acceptable for a narrowly scoped stable utility, but it limits evidence of ongoing maintenance.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months. Combined with the last release being about 21 months ago, this is the main abandonment risk.

Repo popularitycaution

The repository has only 3 stars and 1 fork, indicating a small user base. Popularity is supporting evidence rather than a decisive health measure, especially for a focused utility package.