serve-index

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent. This is a supply-chain transparency gap, but not severe on its own.

Repo bus factorcaution

All recent commits came from one contributor. The organization-owned repository partly compensates because maintenance can be handed off, but recent activity remains concentrated.

Repo commit activitycaution

Only one commit was made by one active maintainer in the last three months. That is a real sign of limited recent maintenance, although the package also has a current release and organization backing.