sade

Build provenancecaution

No build attestation or trusted-publisher metadata is present, limiting publication transparency. This is a provenance gap rather than evidence that the release is unsafe.

Maintainerscaution

Only one registry publishing account is listed, which creates a thin publishing and support base. The linked repository is user-owned, so there is no organizational backing shown to compensate for that concentration.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no demonstrated institutional backing to reduce abandonment risk.

Release historycaution

The latest release was about 4 years ago and there were no releases in the last 12 months, which weakens confidence in ongoing maintenance. The 23-release history shows prior activity but does not offset the current gap.

Repo commit activitycaution

There were no commits or active maintainers in the last 3 months, reinforcing the concern that active maintenance has slowed substantially.