@gitbeaker/requester-utils

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, leaving release origin less verifiable than it could be. This is a transparency gap rather than evidence of maliciousness.

Maintainerscaution

Only one registry account has publish access, creating a narrow publishing control point. The repository's observed release activity partly offsets this, but does not remove the bus-factor concern.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer is not backed by visible organizational ownership. The established repository and release history provide partial compensation.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful sign of slowed source maintenance despite recent registry releases.

Repo issue activitycaution

There were three new pull requests in the last month but no new or closed issues and no merged pull requests, suggesting limited recent throughput.