promise-call-limit

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving publication origin less independently verifiable than releases with attestations.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation or package preparation, adding execution and build behavior that consumers should account for even though no maliciousness judgment is made here.

Release historycaution

The package has six releases over about six years, but none in the last two years, which indicates slow maintenance for a dependency release line.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign of currently quiet maintenance.

Repo toolingcaution

No build tool or security scanning tool is reported in the repository, reducing evidence of automated quality and security checks.