yauzl

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This weakens publication transparency, although it is not by itself evidence that the release is unfit.

Project backingcaution

The repository is owned by an individual rather than an organization, so the small two-account registry maintainer list has limited organizational backing. This adds some continuity risk but is not decisive.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. This conflicts with the recent release cadence and is the main abandonment concern.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month. This is a mild maintenance concern, but the recent release history provides partial compensation.

Repo toolingcaution

The repository reports no build tools and no security-scanning tools. For a small JavaScript library this is a transparency and maintenance-hygiene gap, not a severe risk by itself.