tree-dump

Build provenancecaution

The release has no build attestation, trusted publisher, or staged publishing evidence. The package is transparent enough to inspect, but the release origin is not independently verified.

Maintainerscaution

Only one registry account has publish access, which creates a thin publishing base. This is partly consistent with the repository being owned by an individual and is a manageable concern for a small package.

Release historycaution

The package has five releases over about two years, but none in the past 12 months. That suggests slowing maintenance, though the release history is established rather than abandoned.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the past three months, a meaningful sign of currently quiet development. The repository was still pushed recently enough to avoid treating it as abandoned.

Workflow auditcaution

All four workflows were analyzed successfully with no untrusted checkouts, script injection, or high-severity findings. However, all 11 action references are unpinned, leaving build inputs less reproducible and increasing update risk.