path-scurry

Build provenancecaution

No build attestation or trusted-publisher metadata is present, leaving the relationship between the published artifact and its source less independently verifiable.

Lifecycle scriptscaution

A prepare install-time script is present, which adds execution during installation and modestly increases build transparency and supply-chain exposure.

Maintainerscaution

Only one registry account has publish access. That is a narrow publishing base and creates continuity risk even though repository activity provides some compensating evidence.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single maintainer represents the visible project backing rather than merely a registry access list.

Release historycaution

The package has 30 releases over roughly 3 years, but only 2 releases in the last 12 months despite a historically short median interval of about 3 days, suggesting a marked slowdown.