symlink-or-copy

Build provenancecaution

No registry build attestation or trusted-publisher provenance is present, so consumers have less independent evidence connecting the published artifact to its source. The source tree and release documentation provide some compensating transparency.

Release historycaution

The package has 13 releases over more than 12 years, but none in the last 12 months and the latest release was nearly 7 years ago. This is the strongest evidence of stale maintenance, though the small, stable utility scope partly reduces the concern.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last 3 months, consistent with a project that has largely stopped evolving. No newer release activity compensates for this gap.

Repo toolingcaution

The repository reports no build or security-scanning tooling. For this small JavaScript utility, the lack of a build tool is unsurprising, while absent scanning is a minor maintenance gap.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented. This is a transparency gap, but the package's small scope and lack of runtime dependencies limit its weight.