unique-string

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is recorded. This weakens release transparency, though it is a supply-chain visibility concern rather than evidence that the package is malicious.

Maintainerscaution

Only one account has registry publish access, creating a limited publishing capacity. The linked repository is owned by the same individual, so this is not merely an administrative mismatch, but it still leaves little apparent redundancy.

Project backingcaution

The source repository is owned by an individual rather than an organization, so there is no organizational backing to compensate for the single-maintainer structure. The repository identity and package identity do align.

Release historycaution

The package has only three releases, with no releases in the last 12 months and the latest release from April 2021. That long release gap lowers confidence in ongoing maintenance, although a small stable utility may not need frequent releases.

Repo commit activitycaution

There were no commits and no active maintainers during the last three months, consistent with a project that has seen little recent maintenance. Combined with the old latest release, this is the main adoption concern.