nimma

Lifecycle scriptscaution

The package runs a prepare script during installation, adding execution-time supply-chain surface even though this signal alone does not show malicious behavior.

Maintainerscaution

Only one registry account has publish access, leaving limited publishing redundancy; the linked repository is also user-owned rather than organization-backed.

Release historycaution

The package has 23 releases since May 2020, but none in the last 12 months; the latest release was about 17 months ago, indicating stalled maintenance.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, reinforcing the release-history concern.

Security policycaution

No security policy is present in the repository, reducing transparency for vulnerability reporting and coordinated maintenance.