untyped

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency weakness rather than evidence of an unsafe release.

Release historycaution

The package has 40 releases over more than 11 years, but no registry release in the last 12 months; the latest release was about 19 months ago. This lowers confidence in current maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Despite a recent push timestamp, the measured activity suggests maintenance has slowed.

Repo issue activitycaution

There were two new pull requests in the last month, although none were merged and no issues were closed. This shows limited current activity but is not conclusive abandonment evidence.

Repo toolingcaution

The project uses established build tooling and has a real build pipeline, but no security-scanning tools were detected. Build maturity is positive while security-process coverage is limited.