pngjs

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, limiting release transparency. This is a provenance gap, not a health verdict by itself.

Maintainerscaution

Only one registry account has publish access, which is a narrow publishing base. However, the repository is backed by an organization, so this is mainly a release-continuity concern rather than evidence of an unsupported project.

Release historycaution

The package has existed since 2012 with 24 releases, but it has had no registry release in the last three years. Its long history is reassuring, while the prolonged release gap raises maintenance concerns.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the past three months. Combined with the multi-year release gap, this is the main concern about ongoing maintenance.

Repo issue activitycaution

There was one new issue in the past month, but no issues or pull requests were closed and no pull requests were merged. This suggests limited recent project responsiveness.