point-in-polygon-hao

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot verify how the published artifact was produced. The package is otherwise transparent through its repository and file tree.

Maintainerscaution

Only one registry account has publish access. That can be sufficient for a small package, but it creates a thin publishing and maintenance base with little redundancy.

Release historycaution

The package has 14 releases since 2019, but none in the last 12 months; the latest release was about 21 months ago. This suggests slowed maintenance, despite its previously regular release cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The repository is not abandoned, but current development activity is absent.

Security policycaution

No security policy was found. This is a transparency and response-process gap, although it is less concerning for a small geometry utility than for a security-sensitive package.