resolve-pathname

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable.

Maintainerscaution

One registry maintainer is consistent with a small, individually owned package, but it leaves little visible publishing redundancy.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-person ownership context provides limited organizational continuity.

Release historycaution

The package has had no registry release for more than seven years, despite 13 total releases, which is a meaningful maintenance concern for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing the evidence that maintenance has stalled.