protocols

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing publication transparency. This is a transparency gap, not evidence that the release is unsafe.

Maintainerscaution

Only one registry publishing account is listed. The matching user-owned repository provides continuity, but the single-person publishing base leaves limited redundancy.

Project backingcaution

The repository is owned by a user rather than an organization, so there is no organizational backing signal to offset the thin maintainer base.

Release historycaution

The package has existed since 2015 with 17 releases, but it has had no release in the last 12 months; the latest release was about 19 months ago. This suggests slowing maintenance rather than immediate abandonment.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although the latest release was pushed around the same time, current maintenance activity remains limited.