parse-url

Build provenancecaution

This release has no build attestation, trusted-publisher identity, or staged-publishing evidence, reducing publication transparency.

Maintainerscaution

Only one registry publishing account is listed. The repository is user-owned rather than organization-backed, so there is limited visible publishing redundancy.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, indicating a thin recent maintenance record despite the recent release.

Repo toolingcaution

The repository uses npm scripts for builds but reports no security scanning tools, leaving a maintenance and review gap.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, both action references are unpinned, so their contents can change over time.