tagged-tag

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, leaving publication origin less verifiable. This is a transparency gap rather than evidence that the package is unsafe.

Release historycaution

Only two releases exist, with none in the last 12 months and about a year between releases. That is a modest maintenance concern, though the package is explicitly stable and narrowly scoped.

Repo bus factorcaution

All recent commits came from one contributor, so maintenance depends heavily on a single person. The matching repository and recent activity provide some compensation but do not remove the continuity risk.

Repo commit activitycaution

One commit was recorded in the last three months from one active maintainer. This shows recent activity but indicates limited ongoing maintenance capacity.

Repo toolingcaution

The project uses TypeScript build tooling, but no security scanning tools were detected. For this small type package, the missing scanning is a minor transparency gap.