xml-escape

Release historydanger

The package has only 2 releases, with none in the last 12 months, and its latest release was in March 2016. This is strong evidence of a long-standing maintenance gap, although the package is small and stable.

Repo commit activitydanger

The repository recorded 0 commits and 0 active maintainers in the last 3 months. Combined with the old latest release, this indicates maintenance has effectively stopped.

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This weakens release transparency, though the package is a simple JavaScript artifact without a build pipeline.

Maintainerscaution

Only one registry account has publish access. For this small package that is plausible, but it leaves limited observable publishing capacity if the maintainer becomes unavailable.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no observed organizational backing to compensate for the narrow maintainer base.