parse-png

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This reduces publication transparency, although it is a secondary concern rather than evidence that the release is unsafe.

Release historycaution

The latest release was about seven years ago, with no releases in the last 12 months. The package has six releases and is mature, but the long pause materially raises abandonment risk.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, consistent with the long release gap. This is a meaningful maintenance concern even though the repository is not archived.

Repo toolingcaution

The repository reports no build tooling and no security scanning tools. For a small package this is not disqualifying, but it leaves fewer automated controls around ongoing maintenance.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, though the package's small scope limits the significance of this gap.