refractor

Build provenancecaution

No build attestation or trusted-publisher identity is present. This weakens publication transparency, although it is not by itself evidence that the release is unsafe.

Maintainerscaution

Only one registry account has publish access. That is a thin publishing base and increases continuity risk if that maintainer becomes unavailable.

Release historycaution

The package has 42 releases over more than 9 years, but no releases in the last 12 months; the latest release was about 18 months ago. This indicates a mature but currently inactive release cadence.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last 3 months. Combined with the old latest release, this is a meaningful sign of currently limited maintenance.

Repo issue activitycaution

There are no open issues or pull requests, and no issue or pull-request activity in the last month. This is neutral for a stable package but provides little evidence of current maintenance.