vikry/nsy

Lifecycle scriptscaution

The package runs a post-install-cmd script, which adds install-time behavior and a small amount of supply-chain exposure. No provided signal shows that this script is unsafe, so this is a limited caution rather than a severe risk.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the one-contributor concentration is not visibly backed by an organizational handoff path.

Release historycaution

Only three releases have arrived over about two years, with one release in the last 12 months and intervals of roughly 442 days. The recent release and active repository activity partly compensate, but the cadence is slow.

Repo bus factorcaution

All 20 recent commits came from one contributor, giving the project a single-person maintenance bus factor. The active contributor helps, but there is no observed handoff capacity.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap, though active commits and Dependabot partly compensate.