is-wsl

Build provenancecaution

No build attestation, trusted publisher, or staged-publishing evidence is available, leaving publication provenance less transparent despite the otherwise healthy repository linkage.

Project backingcaution

The repository is owned by an individual account rather than an organization, so continuity depends on a narrow ownership base. The long history and recent release provide some compensation.

Repo commit activitycaution

The repository had no commits and no active maintainers in the last 3 months. The recent release partly offsets this, but the lack of ongoing development is a maintenance caution.

Repo toolingcaution

The repository reports no build tools or security-scanning tools. The package is small and appears to ship directly from simple source files, but this provides limited automated assurance.

Token permissionscaution

The workflow does not declare top-level token permissions, so its least-privilege configuration is unclear. It has no reported top-level write permissions, making this a hygiene caution rather than a severe risk.