smtp-address-parser

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, leaving the origin of the published artifact less verifiable.

Lifecycle scriptscaution

A prepare script runs during installation, adding build-time behavior that deserves review, although this signal alone does not show dangerous activity.

Maintainerscaution

No registry publish-access maintainers are listed. This is a transparency and operational continuity gap, though repository activity provides some compensating evidence.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-person maintenance concentration is not offset by visible organizational backing.

Release historycaution

The package has 10 releases over roughly five and a half years, but it has had no registry release in the last two years, which raises a maintenance-staleness concern.