remark-emoji

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present. This reduces publication transparency, although it is not by itself evidence that the release is unsafe.

Lifecycle scriptscaution

A prepare script runs during installation, adding build or install-time behavior that deserves attention. No evidence here shows that it is harmful, so the effect is limited.

Maintainerscaution

Only one registry account has publish access, which creates a narrow publishing base. The linked repository is user-owned, so there is no organization backing shown to offset that concentration.

Project backingcaution

The repository is owned by an individual account rather than an organization. That does not indicate poor quality, but it provides less visible institutional backing for long-term continuity.

Release historycaution

The package has existed for nearly 10 years with 19 releases, but no releases appeared in the last 12 months. That is a meaningful sign of slower maintenance, though the package has a long release history.