monocart-locator

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, leaving publication provenance less transparent; this is a supply-chain hygiene gap rather than evidence that the release is unsafe.

Maintainerscaution

Only one registry account has publish access. This is a modest bus-factor concern for release continuity, although the linked repository is also maintained by the matching owner.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single registry maintainer represents the available ownership context.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, which weakens evidence of current maintenance despite the recent registry release.

Repo toolingcaution

No build tools or security scanning tools were detected. For this small zero-runtime-dependency package this is a modest transparency gap, not a severe maintenance concern.