thenby

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable; this is a transparency gap rather than evidence of abandonment.

Maintainerscaution

Only one registry publishing account is listed, creating some bus-factor concern, though this is partly supported by the linked user-owned project and recent releases.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which is a maintenance concern, although the release history shows a recent release.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools are configured, leaving a modest review gap.

Security policycaution

No repository security policy is provided, reducing transparency about vulnerability reporting and response.