ms

Build provenancecaution

No build attestation or trusted publisher identity is present, leaving the relationship between source and published artifact less verifiable. The repository's organization backing and CI tooling provide some compensation, but not full provenance.

Release historycaution

The package has existed for over 14 years with 32 releases, but it has had no release in the last year. The long history supports maturity, while the recent pause is a maintenance caution for new changes.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent push and long project history provide some context, but the absence of observed commit activity is a real sign of slowed maintenance.

Repo issue activitycaution

There were two new pull requests in the last month, but no issues or pull requests were closed during that period and 18 pull requests remain open. This indicates limited recent throughput and adds a modest maintenance concern.

Token permissionscaution

One release workflow requests top-level write permissions, and two workflows do not declare top-level permissions. This is a workflow-hardening gap, although no dangerous workflow patterns were detected.