read-package-up

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is available, leaving the origin of the published artifact less transparent.

Maintainerscaution

Registry publishing access is held by one account. That is a limited publishing base, though the linked repository and recent release provide some compensating ownership evidence.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no visible organizational backing to broaden maintenance capacity.

Release historycaution

Only two releases exist across roughly three years, with a median interval of about two years; this indicates limited release history and maturity despite a release within the last year.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent release partly offsets this because the project may be stable, but the absence of current development is a meaningful maintenance concern.