koh/content-provenance

Maintainerscaution

Only one registry account can publish the package. With no organization backing shown, this leaves limited observable publishing redundancy.

Release historycaution

The package is less than a day old with only two releases, published about 5 hours apart. This shows active initial publishing but provides no meaningful long-term maintenance history.

Repo commit activitycaution

The repository has no commits or active maintainers recorded over the last 3 months, although it was pushed very recently and the package itself is brand new. This limits evidence of sustained maintenance rather than proving abandonment.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools are configured. For a package handling signatures, keys, and provenance data, that is a meaningful process gap.

Version stabilitycaution

Version v0.12.1 is not a stable major release, so compatibility and API stability are less established. It is not marked as a prerelease, which partly offsets the concern.