snakecase-keys

Build provenancecaution

No build attestation or trusted-publisher provenance is reported. This weakens release transparency, although the signal alone does not establish that the artifact is unsafe.

Maintainerscaution

Only one registry publishing account is listed. The matching repository and recent historical activity provide some compensation, but the narrow publisher base increases continuity risk.

Release historycaution

This is a mature package with 39 releases since November 2015, but it has had no releases in the last 12 months despite a historical median interval of about 37 days. That slowdown lowers confidence in active maintenance.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months. Combined with no releases in the last 12 months, this is a meaningful sign of slowing maintenance.

Security policycaution

The repository has no published security policy. This is a transparency gap for reporting and handling security issues, though it is not evidence of a vulnerability.