is-ssh

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable. The compact artifact and matching repository license provide some compensating transparency.

Release historycaution

The package has existed for over 11 years with 10 releases, but no release appeared in the last 12 months and the latest release is about 19 months old. This suggests slowing maintenance, although the package is mature and small.

Repo commit activitycaution

The repository recorded no commits and no active maintainers during the last three months, while the latest release is already about 19 months old. This is the clearest abandonment concern in the available evidence.

Repo toolingcaution

The repository reports no build tooling or security scanning. For a tiny JavaScript utility this is not severe, but it reduces evidence of automated maintenance and security checks.

Security policycaution

The repository has no security policy. This is a transparency gap, though the package's small scope and lack of install-time scripts limit its practical weight.