@ethersproject/sha2

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap rather than evidence that the release is unsafe.

Release historycaution

The package has 40 releases over about seven and a half years, but there were no releases in the last 12 months and the latest registry release was in February 2025. This indicates a mature but slowed release line.

Repo bus factorcaution

One contributor made 100% of the eight commits in the last three months. Organization ownership provides some handoff capacity, but no second recent contributor is shown to share the load.

Repo commit activitycaution

The repository recorded eight commits in the last three months, so activity has not vanished, but all eight came from only one active maintainer.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @ethersproject/sha2. Because this is a sub-package in a monorepo, the name mismatch alone is ordinary, but the lack of a README mention leaves package ownership somewhat less transparent.