zwitch

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less independently verifiable.

Lifecycle scriptscaution

A prepack lifecycle script is present, adding build-time behavior that should be understood when reproducing the package, but it is not by itself a severe health concern.

Maintainerscaution

Only one registry account has publish access, which creates a thin publishing base. The linked repository is directly owned by the same individual, so this is a modest resilience concern rather than a standalone severe risk.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing to offset the thin maintainer base.

Release historycaution

The package has 11 releases over more than 10 years, but none in nearly four years and none in the last 12 months. This indicates materially reduced maintenance activity.