sdp-transform

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, leaving release origin less transparent than stronger publishing setups.

Maintainerscaution

Only one registry account has publish access, so release continuity depends on a narrow publishing base; the repository owner is also an individual rather than an organization.

Project backingcaution

The repository is owned by an individual rather than an organization, providing limited visible institutional backing for long-term maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months, a concrete sign that maintenance may have slowed.

Repo toolingcaution

The repository reports no build tooling or security scanning, leaving fewer automated safeguards, though the package is small and has a straightforward source tree.