regjsgen

Build provenancecaution

The release has no build provenance attestation or trusted-publishing evidence. This reduces publication transparency, though it does not by itself show that the package is unsafe to depend on.

Maintainerscaution

Only one registry account has publish access, creating a limited publishing base. The linked repository is also owned by a user rather than an organization, so there is little visible redundancy if that maintainer becomes unavailable.

Release historycaution

The latest registry release was over three years ago, with no releases in the last 12 months and a median interval of about 250 days. This weakens confidence in ongoing release maintenance, although repository activity provides some compensation.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. Recent pull requests and a recent push partly offset this, but the measured commit cadence remains thin.

Security policycaution

The repository has no security policy. For a small focused library this is a documentation gap, but it leaves vulnerability reporting expectations unclear.