update-notifier

Build provenancecaution

No build attestation or trusted-publisher provenance is present, limiting publication transparency. This is a supply-chain hygiene gap rather than evidence that the release is unsafe.

Dependency profilecaution

Ten runtime dependencies add meaningful transitive maintenance surface for a small utility, though the profile is not extreme enough to indicate a severe concern on its own.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no shown organizational backing to compensate for the concentrated recent contribution pattern.

Release historycaution

The package has 53 releases over nearly 14 years, but no registry release in the last 12 months and its latest release was in September 2024, which weakens confidence in ongoing maintenance.

Repo bus factorcaution

All recent repository activity comes from one contributor, creating a concentrated maintenance dependency; the individually owned project provides no organizational handoff evidence to offset it.