spdx-exceptions

Release historycaution

The package has 12 releases since August 2015 but none in roughly 2 years 7 months, indicating that updates have stopped; this may be acceptable for a stable identifier dataset but raises maintenance concern.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, consistent with the release inactivity and leaving little evidence of current maintenance.

Repo package mentioncaution

The repository name differs from the package name and its README does not mention spdx-exceptions, so the source may not clearly belong to this release; the organization owner partly supports legitimacy but does not resolve the mismatch.

Repo toolingcaution

The repository uses npm scripts for building but has no security scanning tools; for a small generated data package this is a modest transparency gap rather than a severe concern.

Security policycaution

No security policy is present, reducing disclosure transparency, although the package appears to contain a small static dataset rather than complex runtime code.