zhead

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, so consumers have limited independent evidence connecting the published artifact to its source build.

Release historycaution

The package has 81 releases since September 2022, but none in the last 12 months and the latest registry release was October 26, 2023. Recent repository activity partly offsets the stale registry cadence, but the release gap remains a maintenance concern.

Repo bus factorcaution

One contributor made all five commits in the last three months, and the registry has one publisher account. This concentration leaves limited demonstrated continuity if that maintainer becomes unavailable.

Repo commit activitycaution

Five commits were made in the last three months, showing current source activity, but all came from one active maintainer and have not produced a registry release in the same period.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts, and the repository contains tests, but no security scanning tools were detected. This is a modest transparency and assurance gap.