mrmime

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This reduces publication transparency, though it is not by itself evidence that the release is unsafe.

Maintainerscaution

Only one registry account has publish access. The repository is correctly linked to that individual, but the narrow publishing base increases continuity risk if that maintainer becomes unavailable.

Project backingcaution

The repository is owned by an individual rather than an organization, consistent with the single registry maintainer; this provides no broader organizational continuity signal.

Release historycaution

The package has existed since 2014 with seven releases, but it had no releases in the last 12 months and its median release interval is about 332 days. The 2.0.1 release is still documented and recent enough to show ongoing publishing.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. This may fit a small stable utility, but it leaves current maintenance capacity unproven.