tdigest

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, reducing release transparency even though no compromise is established by this signal alone.

Maintainerscaution

Only one registry account has publish access. That is a limited publishing base, although repository activity shows another recent contributor.

Project backingcaution

The repository is owned by an individual rather than an organization, so the one-account publishing base and small maintenance footprint have no organizational backing to offset them.

Repo commit activitycaution

The repository recorded two commits in the last three months, showing recent activity but at a sparse pace for ongoing maintenance.

Repo issue activitycaution

There are five open issues and five open pull requests, with no issues or pull requests closed in the last month, suggesting limited demonstrated issue throughput.