nanospinner

Build provenancecaution

No build attestation or trusted-publisher setup was observed, reducing release transparency, although this is a provenance gap rather than evidence of unsafe behavior.

Maintainerscaution

Only one registry publishing account is listed, leaving limited publishing continuity if that maintainer becomes unavailable.

Project backingcaution

The repository is owned by an individual rather than an organization, so the thin maintainer base is not compensated by visible organizational backing.

Release historycaution

The package has 45 releases over about five years, but none in the last 12 months; the latest release was about 21 months ago, indicating stalled maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, matching the roughly 21-month release gap and strengthening the maintenance concern.