stable-hash

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers have less verifiable evidence connecting the artifact to its source build.

Maintainerscaution

Only one registry account has publish access, which creates a thin publishing and recovery base for the package.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no provided organizational backing to offset the narrow maintainer base.

Release historycaution

The package has six releases over about five years, with no releases in the last 12 months; this indicates a slow maintenance cadence, though the repository was pushed recently.

Repo commit activitycaution

There were zero commits and zero active maintainers during the last three months, a concrete sign that active development has paused.