umd

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable. This is a transparency weakness rather than evidence that the release is unsafe.

Lifecycle scriptscaution

The package declares a prepublish lifecycle script. This is a mild build and publication complexity concern, but there is no evidence here that it performs unsafe installation-time behavior.

Release historycaution

The package has 13 releases, but none in the last 12 months and the latest release was about 8 years ago. This makes ongoing maintenance uncertain despite its established history.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. Its last push was in 2022, so current maintenance capacity appears limited.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, while 4 issues and 7 pull requests remain open. This supports the concern that project activity has slowed substantially.