run-series

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This limits publication transparency, although the package is a small direct JavaScript artifact with no runtime dependencies.

Maintainerscaution

Only one registry account has publish access. That is a limited operational base for a user-owned project and increases dependence on a single maintainer.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer is consistent with the project's ownership context but still represents a thin backing base.

Release historycaution

The package has 18 releases since April 2014, but none in the last 12 months and the latest release was in October 2020. This is a meaningful maintenance concern for a dependency, despite its long history.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the absence of releases in the last 12 months, this points to slowed maintenance.