polished

Build provenancecaution

No build attestation, trusted publisher, or staged-publishing evidence is present. The release therefore provides limited verifiable provenance for how the artifact was produced.

Lifecycle scriptscaution

The package defines a prepare install-time lifecycle script. Such scripts can increase installation complexity and execution exposure, so this is a modest supply-chain concern.

Release historycaution

The package has a substantial history with 96 releases since 2016, but the latest release was over two years ago and there were no releases in the last 12 months. This materially lowers confidence in continued maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That is a meaningful sign of slowed maintenance, even though the repository is not archived.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, leaving open issues and pull requests without evidence of current triage. This adds to the maintenance concern.