simple-eval

Build provenancecaution

No build attestation or trusted-publisher identity is present, so consumers have less evidence connecting the artifact to its source and build process.

Lifecycle scriptscaution

A prepare script runs during package installation or development. This is common for build preparation but adds an install-time execution surface.

Maintainerscaution

Only one registry publisher is listed, creating limited publishing redundancy even though the repository is tied to the same individual owner.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-maintainer structure represents genuine continuity risk rather than normal organizational publishing hygiene.

Release historycaution

The package has existed for about five years with six releases, one in the last 12 months, and a median interval of about 263 days; this indicates slow but ongoing maintenance rather than abandonment.