stacktrace-gps

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers cannot independently verify how this release was produced. This is a transparency gap, though it is not proof of an unsafe release.

Lifecycle scriptscaution

The package uses a prepare install-time lifecycle script. That adds execution during installation and deserves scrutiny, although this signal alone does not show malicious or unsafe behavior.

Release historycaution

The package has 32 releases over about 12 years, but its latest release was about four years ago and it had no releases in the last 12 months. This indicates a mature but inactive release stream.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. Together with the old latest release, this raises maintenance and abandonment concerns.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, while 14 issues and 9 pull requests remain open. The unresolved queue is evidence of limited recent project activity.