rambda

Build provenancecaution

The release has no attestation, trusted publisher identity, or staged-publishing record, leaving the artifact-to-source build path less transparent.

Maintainerscaution

Only one registry account has publish access. This is a caution for publishing continuity and account concentration, although the repository shows an identifiable individual owner and substantial project history.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no organizational backing to reduce maintainer continuity risk.

Repo commit activitycaution

The repository reports zero commits and zero active maintainers in the last 3 months, which is a meaningful maintenance concern. Recent release and push timestamps partially offset this, but they do not establish sustained development activity.

Repo toolingcaution

The repository uses TypeScript, Vitest, and Rollup for build and test tooling, but no security scanning tools are detected; the build/test tooling is healthy while the security-hardening gap warrants caution.