keygrip

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so the artifact's publication path is less transparent; this is a secondary concern beside the clear source link and stable package structure.

Release historycaution

The package has 16 releases over roughly 15 years, but none in the last 12 months and the latest release was about seven years ago, indicating prolonged maintenance inactivity.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, reinforcing the release-history evidence that upstream maintenance has effectively stalled.

Repo issue activitycaution

No issues or pull requests were opened or closed in the last month, consistent with a quiet project but not evidence of an abandoned repository by itself.

Repo toolingcaution

The repository reports no build tooling or security scanning, leaving maintenance and security checks less visible; the small, direct package structure partly limits the significance of this gap.