winston-daily-rotate-file

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, leaving the registry artifact's build origin less transparent. This is a supply-chain transparency gap, though not evidence that the release is unsafe.

Release historycaution

The package has 76 releases over more than 10 years, but no releases in the last 12 months; the latest release was over two years ago. This points to materially slowed maintenance despite a strong historical cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the stale registry release history. This raises abandonment risk.

Repo toolingcaution

No build tools or security scanning tools were detected in the repository. The absence of security scanning is a meaningful hygiene gap for a package with a release workflow.

Security policycaution

The repository has no security policy, so vulnerability reporting and response expectations are not documented. This lowers transparency but is not severe on its own.