resolve-workspace-root

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the relationship between source and published artifact less transparent.

Maintainerscaution

Only one registry maintainer is listed, leaving limited publishing continuity if that maintainer becomes unavailable; the repository is also owned by a single user.

Release historycaution

The package has existed for about two years with four releases, but only one release in the last 12 months; this indicates a modest maintenance cadence rather than abandonment.

Repo commit activitycaution

There were no commits and no active maintainers in the past three months, a meaningful sign that maintenance has currently stalled.

Repo toolingcaution

The repository uses TypeScript, ncc, and npm scripts for builds, but has no reported security scanning tooling, leaving a modest hygiene gap.