minipass-sized

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present. This reduces release transparency and makes artifact origin harder to verify.

Lifecycle scriptscaution

A prepare script runs during installation or packaging. This is a review point because lifecycle execution adds build behavior, but it is not severe on its own.

Maintainerscaution

Only one registry account has publish access. The linked repository is user-owned rather than organization-backed, so this leaves a thin publishing and continuity base.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although the package was released recently, the current absence of commit activity raises maintenance risk.

Repo issue activitycaution

There are no new or closed issues in the last month and nine open pull requests, with no merged pull requests in that period. This suggests limited visible issue-response activity.