zxcvbn

Release historydanger

The latest registry release was about 9 years and 7 months ago, with no releases in the last 12 months. Its 25-release history shows past maturity but does not offset the prolonged release gap.

Repo commit activitydanger

The repository recorded 0 commits and 0 active maintainers in the last 3 months, indicating no recent development activity. This is a substantial maintenance concern despite the repository remaining available.

Build provenancecaution

No build attestation or trusted-publisher configuration is present, leaving publication origin less verifiable. This is a transparency weakness rather than proof of an unsafe release.

Lifecycle scriptscaution

The package defines a prepublish lifecycle script. This is not inherently unsafe, but it adds build-time behavior that should be understood when reproducing or auditing publication.

Security policycaution

The repository has no security policy, reducing transparency around vulnerability reporting and maintainer response. The organization backing provides some compensation, but no supplied signal shows an alternative security process.