text-encoding-utf-8

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, so consumers have limited independent evidence about how the artifact was produced.

Lifecycle scriptscaution

A prepublish lifecycle script runs during publishing, adding some execution complexity and supply-chain exposure compared with a package with no lifecycle scripts.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no visible organizational backing to offset the thin maintenance history.

Release historycaution

The package has had 3 releases since November 2015, with no releases in the last 12 months and the latest release in November 2017. This is substantial evidence of dormant maintenance, though the package may be intentionally stable.

Repo issue activitycaution

The repository has one open issue and no issues or pull requests opened or closed in the last month. This is consistent with low current maintenance activity, though the small project scope limits the significance.