use-composed-ref

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is present, leaving artifact origin less independently verifiable.

Lifecycle scriptscaution

The package has a prepare install-time script, adding build or installation behavior that consumers must account for; no other evidence here shows that it is harmful.

Release historycaution

The package has six releases over about seven and a half years, with no releases in the last 12 months; this suggests a slow maintenance cadence, though the latest release is established rather than abandoned for many years.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release interval and raising the risk that fixes will be slow.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, with two open issues and one open pull request; this indicates limited current maintenance rather than a severe backlog.