xhr

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have limited evidence connecting the published artifact to its source build. This is a transparency weakness, not proof of unsafe behavior.

Release historycaution

The package has 60 releases over more than 14 years, but no registry release in the past year and its latest release is nearly six years old. This materially raises staleness risk despite the long historical release record.

Repo commit activitycaution

There were no commits and no active maintainers in the measured three-month window. The repository's May 2025 push shows it is not abandoned outright, but recent development activity is currently limited.

Repo issue activitycaution

There were no new or closed issues or pull requests in the past month, with 10 open issues and 3 open pull requests. This suggests limited current project responsiveness.

Repo toolingcaution

The repository uses a build tool, but no security-scanning tools were detected. For a small package this is a modest hygiene gap rather than a severe maintenance risk.