adm-zip

Build provenancecaution

No build provenance attestation or trusted-publisher identity is present, leaving release origin less independently verifiable.

Maintainerscaution

Only one registry account has publish access, creating some publishing continuity and account-compromise risk, although repository activity shows the project is actively maintained.

Project backingcaution

The repository is owned by an individual rather than an organization, so long-term continuity depends on a relatively narrow project base; this is partly offset by recent release and repository activity.

Token permissionscaution

All three workflows lack top-level permissions declarations, which weakens least-privilege clarity; none declares top-level write access, limiting the observed risk.

Version stabilitycaution

Version 0.6.1 is not a stable-major release, which is a modest compatibility concern, but it is not a prerelease and recent prerelease usage is absent.