set-blocking

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is recorded, leaving release provenance less transparent.

Maintainerscaution

Only one registry account has publish access, which is a thin publishing base. The linked repository is owned by the yargs organization, providing some compensating project backing.

Release historycaution

The package has had only two releases, with the latest published in May 2016 and none in the last 12 months. The repository was pushed more recently, which reduces but does not remove the concern about release maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This supports the concern that active maintenance has slowed, even though the repository is not archived.

Repo toolingcaution

The repository reports no build tooling and no security scanning tools. For a small JavaScript shim this is not severe, but it leaves fewer automated safeguards.