@aws-crypto/sha1-browser

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, leaving release origin less independently verifiable. This is a transparency gap, but not severe enough to outweigh the repository and organization evidence.

Release historycaution

The package has eight releases over about five years, but its latest registry release was nearly three years ago and there were no releases in the last 12 months, which lowers maintenance confidence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although the repository was pushed recently, the measured commit activity indicates limited recent development.

Repo issue activitycaution

There were no new or closed issues or merged pull requests in the last month, despite 25 open pull requests and 8 open issues, suggesting unresolved maintenance backlog.

Workflow auditcaution

All six workflows were analyzed with no untrusted checkout or script-injection findings, and most workflows use read-only permissions. However, all 10 action references are unpinned and a high-confidence audit found ad hoc package installation in the production release workflow, creating a supply-chain hygiene caution.