p-transform

Build provenancecaution

No build attestation, trusted publisher, or staged-publishing evidence is present, so consumers cannot verify how this release was produced. The repository and release notes provide some transparency but do not replace provenance.

Lifecycle scriptscaution

A prepare install-time script runs during installation, adding build or execution behavior beyond file extraction. This is a modest transparency and reproducibility concern, not a health verdict by itself.

Maintainerscaution

Only one registry account has publish access. The matching user-owned repository provides some continuity, but the project has limited publishing redundancy and bus-factor resilience.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing signal to offset the single-maintainer profile.

Release historycaution

The package has 25 releases since November 2021, but it had no releases in the last 12 months and its latest release was in October 2024. That weakens evidence of active maintenance.