wcwidth

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot independently verify how it was published. The package’s simple contents and lack of install scripts provide some compensating evidence.

Release historycaution

The package has only three releases and none in the last 12 months; its latest release was in May 2016, indicating a long period without registry updates. This is a meaningful maintenance concern, though the package’s narrow scope and stable version reduce the likelihood that frequent releases are necessary.

Repo commit activitycaution

There were no commits and no active maintainers in the measured three-month period, which is the strongest evidence of limited ongoing maintenance. The repository’s 2023 push shows it is not entirely abandoned, but does not establish current activity.

Repo issue activitycaution

There are three open issues and two open pull requests, but no new or closed issues or pull requests in the last month, suggesting little recent project engagement.

Repo toolingcaution

The repository has no build tooling or security scanning configured. For this small, directly published JavaScript library this is a transparency and maintenance gap, though the simple file tree limits its practical significance.