@aws-crypto/sha256-js

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, leaving the connection between source and published artifact less transparent.

Release historycaution

The package has 19 releases over nearly eight years, but no release in the last 12 months and the latest release was in October 2023; this weakens confidence in ongoing maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, a concrete sign that maintenance has slowed substantially.

Repo issue activitycaution

No issues or pull requests were opened or merged in the last month, and 25 pull requests remain open; this adds to the evidence of limited current activity.

Workflow auditcaution

All six workflows were analyzed with no untrusted checkouts or script injection, but all ten action references are unpinned and a high-confidence release workflow installs a package outside the lockfile.