resolve-from

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is available, leaving the connection between source and registry artifact less transparent.

Release historycaution

The package has six releases over more than 12 years, but no releases in the last seven years, indicating a mature yet inactive release line.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing the lack of recent maintenance evidence.

Repo toolingcaution

The repository reports no build tooling or security scanning tools, so automated safeguards are not evident.

Token permissionscaution

The single workflow has no top-level token permissions declaration, making its default permissions less explicit than a least-privilege configuration.