re-resizable

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This limits publication transparency, but it is not by itself evidence that the release is unsafe.

Release historycaution

The package has existed for about 9 years with 97 releases, but it has had no releases in the last 12 months. That suggests slowing maintenance rather than abandonment by itself.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. This is a meaningful maintenance warning, although the project was pushed recently and is not archived.

Security policycaution

No security policy was found in the linked repository. This weakens vulnerability-reporting transparency, though the package otherwise shows established documentation and licensing.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-confidence audit findings, but all 9 action references are unpinned. That is a supply-chain hygiene gap without evidence of an active exploit path.