minipass-pipeline

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing release transparency even though this is not a direct maintenance failure.

Lifecycle scriptscaution

A prepare install-time script adds build or installation complexity and deserves attention, though this signal alone is not evidence of abandonment.

Maintainerscaution

Only one registry account has publish access, creating a thin publishing base; the repository owner is the same individual, which provides some consistency but not redundancy.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no demonstrated organizational backing to offset the thin maintainer base.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful sign that active maintenance may have slowed despite a recent package release.