side-channel-list

Build provenancecaution

No build provenance attestation or trusted publisher is present, leaving publication origin less independently verifiable.

Lifecycle scriptscaution

The package uses prepack and prepublish scripts. These are common for preparing published artifacts but add install or publication behavior that consumers should account for.

Maintainerscaution

Only one registry publishing account is listed. The matching repository and recent release reduce concern about a disconnected publisher, but the project still has limited maintainer redundancy.

Release historycaution

The package has only two releases across 647 days, with one release in the last 12 months and a median interval of about 484 days. This indicates a slow but not necessarily abandoned release cadence for a small utility.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent release and push provide some compensation, but current maintenance capacity is still thin.