onetime

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less independently verifiable; this is a transparency gap rather than evidence of an unhealthy package.

Maintainerscaution

A single registry publisher is less redundant than a broader publishing group, but the linked repository is maintained under the same individual owner and the package has a long release history.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is limited visible organizational redundancy behind the package.

Release historycaution

The package has existed for over 12 years and has 15 releases, but only one release appeared in the last 12 months, indicating a deliberately slow cadence or reduced activity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent version release partly offsets this, but the lack of current development activity raises maintenance concerns.