uqr

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is recorded, leaving release origin less verifiable than it could be.

Release historycaution

The package is over three years old with nine releases, but only one release appeared in the last 12 months, indicating a slow maintenance cadence.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months. The recent release partly offsets this, but the observed development activity is currently quiet.

Repo toolingcaution

The project uses established TypeScript and build tooling, but no security-scanning tools are configured, leaving a modest process gap.

Security policycaution

No repository security policy is present, which reduces transparency for vulnerability reporting but is not by itself evidence of abandonment.