spex

Build provenancecaution

The release has no build attestation, trusted publisher identity, or staged-publishing evidence, reducing transparency into how the artifact was produced.

Maintainerscaution

Only one registry account has publish access, creating a limited publishing and continuity base. The repository is user-owned rather than organization-owned, so there is no organizational backing signal to offset that concentration.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a real maintenance concern, although the recent release and long history provide some compensation.

Repo toolingcaution

The repository uses a build tool, but no security scanning tools were detected. This is a hygiene gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.