sass-graph

Build provenancecaution

The release has no recorded build attestation, trusted publisher, or staged publishing. This reduces publication transparency, although it is not evidence that the package is malicious.

Project backingcaution

The repository is owned by an individual account rather than an organization. This does not make the package unhealthy, but it provides less evident institutional backing for long-term maintenance.

Release historycaution

The package has 30 releases since February 2014, but its latest release was about four years ago and there were no releases in the last 12 months. This indicates a mature but inactive release cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with roughly four years since the last release. This is the strongest abandonment concern, partly offset by the repository not being archived.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, while six issues and five pull requests remain open. Combined with the stale release history, this suggests limited current maintenance.