keycloak-js

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication authenticity less transparent even though other repository signals are strong.

Repo bus factorcaution

All three-month commit activity comes from one contributor, creating concentration risk; organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, indicating slow recent source activity despite the recent package release and release notes.

Repo issue activitycaution

The repository received two new issues and five new pull requests in the last month, but closed no issues or pull requests, which is a modest sign of unresolved maintenance backlog.

Token permissionscaution

All four workflows lack top-level token permission declarations. No workflow has top-level write permissions, but the absence of explicit restrictions leaves permissions less clear than desired.