table

Build provenancecaution

No build attestation or trusted publisher metadata is present, leaving the artifact-to-source publishing path less transparent. The matching repository, source tree, and release notes provide some compensating context, but not verifiable provenance.

Project backingcaution

The repository is owned by an individual account rather than an organization. That is not inherently unhealthy, but it provides less visible institutional backing for a project whose recent activity has stopped.

Release historycaution

The package is mature, with 88 releases over nearly 16 years, but it has had no releases in the last 12 months. The long history helps compensate for the recent publishing gap, but does not remove the maintenance concern.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Combined with no registry releases in the last 12 months, this is the main reason to treat the package as usable with maintenance caveats.

Repo issue activitycaution

The repository has 26 open issues and 7 open pull requests, but recorded activity in the last month is zero for both issues and pull requests. This is consistent with the broader sign of slowed maintenance.