open

Build provenancecaution

No build attestation or trusted-publisher provenance is present, which weakens publication transparency, but the package has a long release history and an active matching repository.

Project backingcaution

The repository is owned by an individual rather than an organization, so the one-person publishing and concentrated contribution pattern represents a real continuity limitation.

Repo bus factorcaution

Two contributors were active, but the primary contributor made 7 of 8 recent commits, leaving maintenance substantially concentrated and creating a moderate continuity risk.

Repo toolingcaution

The repository reports no build tools or security-scanning tools. This is a transparency and assurance gap, although the small package and active maintenance partly limit its significance.

Token permissionscaution

The only workflow does not declare top-level token permissions, so its effective permissions are less explicit than preferred even though no write permissions were detected.