normalize-range

Release historydanger

The package has had no registry release in over 11 years and has only 3 releases overall, which is a substantial maintenance concern for a dependency.

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent, although the package is a small unbuilt JavaScript artifact.

Project backingcaution

The repository is owned by an individual rather than an organization, so the project has a narrower apparent backing base; this is relevant alongside the limited recent activity.

Repo commit activitycaution

No commits or active maintainers were recorded in the last 3 months, so current repository activity does not demonstrate sustained maintenance despite the recent push timestamp.

Repo toolingcaution

The repository reports no build tool or security scanning tool, leaving limited automated assurance; this is a hygiene gap for a small, dependency-free package.