jws

Build provenancecaution

The release has no build provenance attestation or trusted-publisher identity, reducing transparency about how the registry artifact was produced. The repository's release tooling and security scans provide some compensating project hygiene.

Repo bus factorcaution

All recent repository commits came from one contributor, creating a concentrated maintenance risk. Organizational ownership provides some handoff capacity, but no second recent contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, with one active maintainer, indicating a slow recent maintenance pace despite the recent release history.

Repo issue activitycaution

There are 20 open issues and 13 open pull requests, but no issues or pull requests were created or closed in the last month; this suggests limited recent responsiveness.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations less transparent for a security-sensitive signing library.