typical

Build provenancecaution

The release has no build attestation or trusted-publisher provenance. This limits publication transparency but is partly offset by the package's straightforward artifact and repository structure.

Maintainerscaution

Only one registry publishing maintainer is listed, creating a thin publishing base and some continuity risk. The linked repository is also owned by a single user rather than an organization.

Release historycaution

The package has 29 releases over more than 12 years, but no releases in the last 12 months; the latest release was in November 2024. This indicates a mature but currently inactive release cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That weakens evidence of ongoing maintenance, although the package is already mature and stable.

Security policycaution

The repository has no security policy. This is a transparency and vulnerability-reporting gap, though it is not evidence that the package is unsafe.