path-key

Build provenancecaution

No build attestation or trusted publisher provenance is present, reducing publication transparency, although this is not by itself evidence that the package is unhealthy.

Maintainerscaution

A single registry publishing account is consistent with the repository being owned by an individual maintainer, but it also indicates limited publishing redundancy.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-maintainer model represents a real continuity limitation.

Release historycaution

The package has existed since December 2015 with seven releases, but its latest registry release was in April 2021 and there were no releases in the last 12 months, which is a maintenance concern.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which weakens evidence of ongoing maintenance despite the repository's recent push timestamp.