real-require

Build provenancecaution

This release has no build attestation or trusted-publisher provenance, reducing publication transparency; the package's simple artifact and lack of runtime dependencies partly limit the concern.

Release historycaution

The package has only 3 releases across nearly 5 years, with a median interval of about 795 days; one release in the last 12 months provides some current activity but the cadence is sparse.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, which weakens evidence of ongoing maintenance despite a recent release.

Workflow auditcaution

Both workflows were fully analyzed with no reported findings and no untrusted triggers or write permissions, but all 5 action references are unpinned, leaving avoidable reproducibility risk.