object.getownpropertydescriptors

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the relationship between the published artifact and its source less independently verifiable. The repository and artifact contents otherwise align.

Dependency profilecaution

Seven runtime dependencies create some transitive maintenance surface for a small shim, but the listed dependencies are focused on compatibility and safety helpers rather than an unusually broad stack.

Maintainerscaution

Only one registry account has publish access, which creates a narrow publishing path. The organization-owned repository provides some compensating backing, but it does not eliminate single-publisher concentration.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. This is a meaningful sign of currently quiet development, though the recent registry release and long project history reduce abandonment concern.

Workflow auditcaution

All five workflows were analyzed successfully with no reported audit findings, and the pull_request_target workflows have no untrusted checkouts or script-injection sinks. However, all five action references are unpinned, leaving avoidable action-version supply-chain exposure.