oblivious-set

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, reducing release transparency and verification.

Lifecycle scriptscaution

A prepublish lifecycle script is present, adding build-time complexity compared with a package that has no lifecycle hooks, but it is not by itself a severe concern.

Maintainerscaution

Only one registry account has publishing access, leaving little publishing redundancy even though registry access records do not establish actual project activity.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing shown to compensate for the thin maintainer base.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, indicating currently quiet development despite the recent registry release.