safe-regex-test

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have less independently verifiable evidence connecting the artifact to its source. This is a transparency gap, not a health verdict by itself.

Lifecycle scriptscaution

The package has prepack and prepublish lifecycle scripts, which add publishing and installation-chain complexity compared with a package without lifecycle automation. They are not evidence of malicious behavior on their own.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing signal to offset the small maintainer base.

Release historycaution

The package has five releases over about four years, but none in the last 12 months and the latest release was in December 2024. This indicates a meaningful release-cadence gap, though the package is mature and stable.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, which weakens evidence of current maintenance. The repository was nevertheless pushed recently according to the repository status signal.