string.prototype.includes

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, so consumers cannot verify release provenance from this signal.

Release historycaution

The package has only three releases over about 12 years, with no release in roughly two years. Its long history supports maturity, but the very slow cadence raises maintenance concerns.

Repo commit activitycaution

There were no commits or active maintainers in the last three months, consistent with the long release gap. The package may be stable, but current maintenance capacity is not demonstrated.

Repo issue activitycaution

There was no issue or pull-request activity in the last month, with one issue and one pull request still open. This reinforces the limited evidence of active maintenance.

Repo toolingcaution

The repository reports no build tooling or security scanning. That is a transparency and process weakness, although the small, tested package reduces the significance of the gap.