structured-headers

Build provenancecaution

The release has no build attestation or trusted-publisher identity. This weakens publication transparency, though it is not evidence that the artifact is unsafe by itself.

Lifecycle scriptscaution

The package uses a prepare lifecycle script. This is a modest supply-chain and installation-complexity concern, although the package has no runtime dependencies and the available build structure provides context for the script.

Maintainerscaution

Only one registry account has publish access. Registry access lists do not prove maintenance capacity, but this is still a limited publishing base when considered alongside the repository's single active contributor.

Project backingcaution

The repository owner is an individual user, not an organization. That aligns with the observed single-contributor bus factor and provides no additional institutional maintenance buffer.

Repo bus factorcaution

One contributor made 100% of the 8 recent commits. Because the owner is an individual rather than an organization, there is no shown organizational handoff capacity.