raf

Build provenancecaution

No build attestation or trusted-publisher identity is present. This leaves publication provenance less independently verifiable, although the package is a small and transparent artifact.

Project backingcaution

The repository is owned by an individual user rather than an organization. This is not inherently unhealthy, but it provides less visible institutional backing for long-term maintenance.

Release historycaution

The latest registry release was November 2, 2018, with no releases in the last 12 months. That long gap is a meaningful maintenance concern, though the package has 24 releases and is mature.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Combined with the old latest registry release, this indicates a largely inactive project.

Repo toolingcaution

The repository uses webpack but has no detected security-scanning tools. The missing scanning is a modest hygiene gap rather than evidence of abandonment.