remove-bom-buffer

Build provenancecaution

No build provenance attestation or trusted-publisher information is present. This limits publication transparency, but it is not by itself evidence that the release is unsafe to depend on.

Release historycaution

The package has had no registry release in about nine years, with all three releases concentrated in June and July 2017. This is a meaningful maintenance concern for a dependency, although the package is a small, stable utility.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long gap since the latest release. That lowers confidence in ongoing maintenance rather than making this simple utility unusable on its own.

Security policycaution

The repository has no security policy. This is a transparency and reporting gap, but it is less significant for a small, narrowly scoped utility than for a security-sensitive package.