to-valid-identifier

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent, though this is not by itself evidence of an unhealthy package.

Release historycaution

The package is about 865 days old with three releases and one release in the last 12 months; this is a deliberate, low-frequency cadence but indicates limited recent release activity.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months, indicating that maintenance has recently gone quiet.

Repo toolingcaution

No build tool or security scanning tool was detected. For this small package the build gap is limited, but the absence of security scanning is a modest transparency and hygiene concern.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings or untrusted checkout/script-injection paths. However, both action references are unpinned, so their exact versions are not reproducible.