tslib

Build provenancecaution

No build attestation or trusted-publisher identity was found, so the release has limited publication provenance transparency. This is a supply-chain hygiene gap, but it is not outweighed by evidence of abandonment here.

Release historycaution

The package has existed for 4,279 days with 48 releases and a median release interval of about 43 days, but it has had no registry release in the last 12 months. The long history and recent version-specific release notes compensate for the current pause, making this a caution rather than a severe abandonment signal.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, which is a real current-maintenance concern. The package's long release history, stable version, release notes, and organization backing provide meaningful compensation.

Repo issue activitycaution

The repository has 36 open issues and 21 open pull requests, but no new issues or pull requests were recorded in the last month and none were merged. This suggests limited current throughput, though the backlog is not by itself evidence that the package is unfit.

Token permissionscaution

Two workflows declare read-only permissions and none declare top-level write access; one CodeQL workflow lacks top-level permissions. This is a minor permissions-hygiene gap rather than an excessive-token risk.