plur

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, so the release has limited verifiable publication provenance.

Repo commit activitycaution

There were no commits or active maintainers in the last 3 months. The recent release and repository push partly offset this, but the quiet development window is a maintenance caution.

Repo toolingcaution

The repository reports no build tool or security scanning tool. This is a modest transparency and process gap, though the package is small and its release structure is clear.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings or untrusted checkouts, but both action references are unpinned. That leaves avoidable workflow reproducibility and update risk.