smob

Build provenancecaution

The release has no build attestation or staged publishing, so consumers receive less independently verifiable evidence about how the artifact was produced.

Project backingcaution

The repository is owned by an individual rather than an organization, so the project has limited visible institutional backing and relies on one owner’s capacity.

Repo commit activitycaution

There were no commits and no active maintainers during the last three months, a meaningful maintenance concern despite the repository having been pushed recently and the registry showing recent releases.

Repo issue activitycaution

There is one open issue and 15 open pull requests, with no new or merged pull requests in the last month. The backlog adds evidence of limited current throughput.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations undocumented. This is a transparency gap, but not by itself evidence that the package is unsafe.