store2

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have limited evidence connecting the published artifact to its build process.

Maintainerscaution

Only one account has registry publish access. That is not proof of abandonment, but it leaves a thin visible publishing base when recent release activity is also absent.

Project backingcaution

The repository is owned by an individual rather than an organization, so the one-account maintainer base provides limited visible project backing.

Release historycaution

The package has a long history with 46 releases, but it has had no release in the past 12 months; the latest release was in December 2024, indicating slower maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the past three months, a concrete sign of slowed development and increased abandonment risk.