object-keys

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent than a release with verifiable provenance.

Maintainerscaution

One registry maintainer account is listed, which is a thin publishing base; repository evidence shows the project is tied to that same owner but does not establish a broader active team.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer is not offset by explicit organizational backing.

Release historycaution

The package has 33 releases but its latest registry release was in April 2019, with no releases in the last 12 months; this materially raises staleness risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, weakening evidence of ongoing maintenance even though it was pushed recently.