unherit

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot independently verify how the artifact was produced.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer does not show organizational backing and the maintenance bus factor is limited.

Release historycaution

The package has 12 releases since July 2015, but none in the last 12 months and its latest release was in November 2022, indicating materially slowed maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, providing no evidence of current maintenance capacity.

Repo toolingcaution

The repository uses TypeScript and npm scripts for builds, but has no security scanning tools. The build tooling is a positive, while the missing scanning is a modest transparency gap.