uhyphen

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing release transparency. This is a supply-chain hygiene gap rather than evidence that the release is unsafe.

Maintainerscaution

Only one registry maintainer is listed, leaving limited publishing redundancy. The linked repository is owned by the same individual, which provides some continuity but not a broad maintainer base.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-maintainer concern is not offset by organizational backing.

Release historycaution

The package has only 3 releases and none in the last 12 months; its latest release was nearly four years ago. This suggests maintenance has stopped, although a small utility may need few changes.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, consistent with the stale release history. This is the strongest abandonment concern, though the utility's small scope partly limits its practical impact.