unbox-primitive

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent than it could be.

Lifecycle scriptscaution

The package uses prepack and prepublish scripts. These are common for publishing generated artifacts but add release-process complexity.

Project backingcaution

The repository is owned by an individual rather than an organization, so the project has a narrower formal backing structure; the active repository and supporting project files partly compensate.

Release historycaution

The package has four releases over roughly seven years, with no releases in the last 12 months and a median interval of about 592 days. This indicates a slow maintenance cadence, though the package may be stable.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which is a meaningful sign of currently quiet maintenance.