rambda

Rambda 11.3.0 appears generally suitable to depend on: it has a long release history since 2017, frequent recent releases, a stable major version, an active non-archived repository, matching package/repository identity, clear licensing, tests in the repository, and no runtime dependencies or install-time scripts. The main concern is that repository commit activity reports zero commits and zero active maintainers over the last 3 months, despite a release being published recently and the repository being pushed recently; this creates some uncertainty about sustained maintenance. A single registry publisher, absent build provenance, missing security scanning, and workflows without top-level token permissions are additional transparency and hardening gaps, but none alone indicates the package is unfit.

Latest 11.3.0

NPM

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Attestations

Health Score Breakdown

Build provenance

The release has no attestation, trusted publisher identity, or staged-publishing record, leaving the artifact-to-source build path less transparent.

Maintainers

Only one registry account has publish access. This is a caution for publishing continuity and account concentration, although the repository shows an identifiable individual owner and substantial project history.

Project backing

The repository is owned by an individual user rather than an organization, so there is no organizational backing to reduce maintainer continuity risk.

Repo commit activity

The repository reports zero commits and zero active maintainers in the last 3 months, which is a meaningful maintenance concern. Recent release and push timestamps partially offset this, but they do not establish sustained development activity.

Repo tooling

The repository uses TypeScript, Vitest, and Rollup for build and test tooling, but no security scanning tools are detected; the build/test tooling is healthy while the security-hardening gap warrants caution.