p-locate

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so the registry artifact's origin is less independently verifiable.

Project backingcaution

The repository is maintained under a named individual owner rather than an organization, so the single registry maintainer provides limited bus-factor support.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a maintenance warning partly offset by the recent 7.0.0 release and recent repository push.

Workflow auditcaution

The single workflow was fully audited with no high-confidence findings or untrusted-trigger sinks, but both action references are unpinned, leaving avoidable build-reproducibility risk.