exec-sh

Build provenancecaution

No build provenance attestation or trusted-publisher identity is present, reducing release transparency, though this is a transparency gap rather than evidence of malicious behavior.

Maintainerscaution

Only one registry account has publish access, leaving limited publishing redundancy; the repository is also owned by an individual rather than an organization.

Project backingcaution

The repository is owned by an individual account, so there is no organization backing shown to compensate for the thin maintainer base.

Release historycaution

The package has 15 releases since June 2014, but none in the last 12 months and the latest release was over five years ago, indicating substantially slowed maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with a project whose maintenance has largely stopped.