redlock

Build provenancecaution

No build attestation or trusted-publisher identity is present, reducing release transparency. This is a supply-chain hygiene gap rather than evidence that the release is unsafe.

Lifecycle scriptscaution

The package runs a prepare lifecycle script during installation. This is not inherently unsafe, but it adds install-time behavior that should be understood when using a prerelease dependency.

Maintainerscaution

The registry lists one publishing account. The linked repository is user-owned rather than organization-owned, so the narrow publisher base provides limited redundancy.

Release historycaution

The package has existed since 2015 with 27 releases, but it has had no registry release in the last 12 months; the latest release is from March 2022. This materially raises maintenance and abandonment concerns.

Repo commit activitycaution

There were zero commits and zero active maintainers in the three months measured, indicating that active development has currently stalled despite the repository not being archived.