nanoclone

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, leaving limited independent assurance about how the artifact was produced.

Lifecycle scriptscaution

A prepublish lifecycle script is present, adding build-time behavior that should be understood before publishing or upgrading, though this alone is not severe.

Maintainerscaution

Only one registry maintainer is listed. That is workable for a small user-owned package but creates a thin continuity and bus-factor profile.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single-maintainer concern is not offset by visible organizational backing.

Release historycaution

The package has 11 releases but none in the last 12 months; the latest release was about 3 years ago, which raises maintenance and abandonment concerns.