shellwords

Build provenancecaution

No build attestation or trusted-publisher identity is available, reducing release transparency, though this is a provenance gap rather than evidence of an unsafe release.

Lifecycle scriptscaution

A prepublish lifecycle script is present, adding a small publishing-process concern, but it is not an install-time runtime script.

Maintainerscaution

Only one registry publishing account is listed, creating limited publishing redundancy; the linked repository is also owned by an individual rather than an organization.

Project backingcaution

The repository is owned by an individual account, so there is no organizational backing signal to compensate for the single-maintainer structure.

Release historycaution

The package is mature, with eight releases since 2011, but it has had no registry release in over a year, which raises a modest maintenance concern.