The `postinstall` script helper for handling native bindings in legacy `npm` versions
68%
Total Score
63
94
88
100
Only one registry account has publish access, which creates a thin publishing base; organization ownership provides some compensating project backing but does not remove the operational concentration.
The package has 18 releases over about 17 months, but only one release in the last 12 months, indicating that release activity has slowed materially after an initially active cadence.
The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign that ongoing maintenance may have paused.
Seven issues and six pull requests remain open, with no issues or pull requests closed in the last month; this suggests unresolved maintenance demand.
All seven workflows were analyzed without failed files or high-severity findings. Two high-confidence low-severity adhoc-package findings and one unpinned action are minor hygiene concerns; trusted publishing is a positive supply-chain practice here.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.