spdx-compare

Release historydanger

The package has only 3 releases and none in the last 12 months; its latest registry release was over 8 years ago, which materially raises abandonment risk.

Build provenancecaution

The release has no build attestation or trusted-publisher metadata, so consumers cannot verify how the published artifact was produced. This lowers supply-chain transparency but is not severe on its own.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, providing no evidence of current maintenance despite the repository not being archived.

Repo popularitycaution

With 3 stars, 4 forks, and 1 watcher, the project has limited community visibility. Popularity is supporting evidence only, so this modestly reduces confidence rather than determining the verdict.

Repo toolingcaution

The repository reports no build tools and no security-scanning tools. This is a transparency and maintenance-hygiene gap, though the package is small and has no install-time lifecycle scripts.