patch-console

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing release transparency, but this is a moderate gap rather than evidence that the artifact is unsafe.

Lifecycle scriptscaution

A prepare script runs during installation, adding build-time behavior that should be understood by consumers, though this signal alone is not a severe dependency risk.

Maintainerscaution

Only one registry account has publish access, leaving little publishing redundancy, although the linked repository is also owned by that individual.

Release historycaution

The package has only two releases and none in the last 12 months; its latest release was published in February 2022, indicating a long inactive period for a maintained dependency.

Repo commit activitycaution

There were no commits and no active maintainers in the measured three-month period, reinforcing the evidence that maintenance has stopped or substantially slowed.