netmask

Build provenancecaution

No build attestation or trusted-publisher evidence is present, reducing publication transparency, but this is a provenance gap rather than evidence of abandonment.

Lifecycle scriptscaution

A prepublish lifecycle script is present; this deserves limited caution because lifecycle behavior can affect publishing, but it is not an install-time script.

Maintainerscaution

Only one registry publishing account is listed, which is a modest continuity concern for package publication, although repository activity shows more than one active contributor.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer and small contributor base provide less institutional maintenance redundancy.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response guidance undocumented.