resolve-path

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the relationship between the published artifact and source repository less independently verifiable. This is a supply-chain transparency gap, though not evidence that the package is unsafe.

Release historycaution

The package has a long history with 10 releases, but its latest registry release was in February 2018 and there have been no releases in the last 12 months. That strongly lowers confidence in ongoing maintenance, despite the package's maturity.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Combined with no registry releases since February 2018, this is the main reason to treat the package as aging and maintenance-constrained.

Repo issue activitycaution

The repository has one open issue and four open pull requests, but none were opened or merged in the last month. Unresolved activity is a modest maintenance concern rather than evidence of abandonment by itself.

Repo popularitycaution

The repository has 34 stars and 14 forks, providing some evidence of use but limited community scale. Popularity is supporting evidence only and does not overcome the inactive release history.