tempfile

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving release origin less independently verifiable. This is a transparency gap rather than evidence that the release is unsafe.

Maintainerscaution

Only one registry account has publish access, creating limited publishing resilience. The linked repository is also owned by an individual, so no organizational backing is shown to compensate for that concentration.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing signal to broaden maintenance capacity.

Repo commit activitycaution

There were no commits and no active maintainers in the past three months, indicating quiet development. The recent registry release partly offsets this, but does not remove the maintenance-resilience concern.

Repo toolingcaution

The repository uses no build tool and reports no security-scanning tool. The package is small and directly published, so the missing build tooling is not material, but the absence of scanning modestly reduces transparency.