userhome

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so release origin is less independently verifiable. This is a transparency limitation rather than evidence of unsafe behavior.

Maintainerscaution

Registry publishing access is held by one account, which limits the visible publishing base; the linked repository is also user-owned, so no organizational backing compensates for that concentration.

Release historycaution

The package has only three releases across more than 13 years, with no release in nearly two years and none in the last 12 months. This is a meaningful maintenance concern, though the package is small and stable.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, despite not being archived. This weakens evidence of active maintenance.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting guidance undocumented. This is a modest transparency gap for a small utility.