toggle-selection

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable; this is a transparency gap rather than evidence the release is unsafe.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer represents a genuinely thin visible ownership base.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. Recent release activity partly offsets this, but the lack of observed development is a meaningful maintenance concern.

Repo issue activitycaution

The repository has 2 open issues and 3 open pull requests, but no issues or pull requests were opened or merged in the last month, indicating limited current collaboration.

Repo toolingcaution

The repository reports no build tooling and no security scanning tools. For this small package the build gap is understandable, but the absence of security scanning reduces project safeguards.