resolve-alpn

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This limits publication transparency, but the package is a small direct JavaScript artifact with no build step shown.

Maintainerscaution

Only one registry publishing account is listed. That is not proof of poor maintenance, but it leaves limited visible publishing redundancy when combined with inactive repository activity.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no demonstrated organizational backing to offset the single-maintainer and inactivity concerns.

Release historycaution

The package has had no release in about five years, despite seven releases overall; this is meaningful evidence of inactive maintenance for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months; together with the old latest release, this indicates maintenance has effectively stopped.