tiny-invariant

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable. The clear source repository and simple artifact provide some transparency but do not replace provenance.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer is consistent with the project backing but leaves a thin continuity base.

Release historycaution

The package has 21 releases since April 2018, but none in the last 12 months and its latest release was about two years ago. This suggests slowing maintenance, partially offset by its long history and stable release pattern.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, consistent with the release gap and indicating limited current maintenance capacity.

Repo issue activitycaution

There are open issues and pull requests, but none were opened or closed and no pull requests were merged in the last month, reinforcing the limited recent activity.