spdx-satisfies

Maintainerscaution

Only one registry account has publish access, creating a thin publishing base, although the repository is owned by an organization, which partly reduces single-person continuity risk.

Release historycaution

The package is mature, with 9 releases over more than 11 years, but it has had no release in the past 12 months; this indicates a slower maintenance posture.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, consistent with the quiet release history and raising maintenance-risk concerns.

Repo toolingcaution

The repository reports no build tool and no security-scanning tool; this is a transparency and maintenance gap, though the package is small and straightforward.

Security policycaution

No security policy is present, leaving the process for reporting and handling vulnerabilities unclear.