postgres

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is present, leaving the origin of the published artifact less transparent.

Lifecycle scriptscaution

A prepare install-time script is present, adding some installation complexity, but this signal alone does not show unsafe behavior or materially undermine package health.

Maintainerscaution

Only one registry account has publish access. This is a limited publishing base, though the repository is also linked to an individual owner rather than an organization.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no organizational backing shown to offset the concentrated maintainer and contributor activity.

Repo bus factorcaution

One contributor made all two commits in the last three months, giving the project a concentrated short-term bus factor with no second active contributor shown.