min-document

Build provenancecaution

The release has no build attestation, trusted publisher, or staged-publishing evidence, so registry artifacts cannot be independently tied to a recorded build. The matching source tree and recent release provide some compensating transparency.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last three months, which weakens evidence of ongoing maintenance. The release was still published recently, so this is a caution rather than an abandonment verdict.

Repo issue activitycaution

There were 0 new or closed issues and 0 merged pull requests in the last month, with 10 open issues and 3 open pull requests. This indicates limited recent project activity, although open work remains visible.

Repo toolingcaution

The repository reports no build tools and no security scanning tools. For this small JavaScript package, that is a transparency and hygiene gap, but it does not by itself indicate that the package is unfit.

Security policycaution

No security policy was found in the linked repository, leaving vulnerability-reporting expectations undocumented. This is a maintenance and transparency gap, not evidence of malicious behavior.