sf-symbols-typescript

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present. This leaves release origin less independently verifiable, though it is a transparency limitation rather than evidence of an unsafe release.

Project backingcaution

The repository is owned by an individual rather than an organization. That is not inherently unhealthy, but it provides less visible institutional continuity if the maintainer stops contributing.

Release historycaution

The package has five releases over about three and a half years, with one release in the last 12 months and a median interval of about 327 days. This indicates slow but continuing maintenance rather than abandonment.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with only one registry release in the last year, this points to slow maintenance and some abandonment risk.

Repo toolingcaution

The repository uses TypeScript and npm scripts, but reports no security scanning tools. For a small type-only package this is a modest oversight gap.