language-subtag-registry

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, leaving publication origin less independently verifiable than a release with attestations.

Maintainerscaution

Only one registry publishing account is listed, so publishing continuity depends on a single person. The linked repository is also owned by an individual, with no organizational backing shown.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no demonstrated organizational continuity behind the package.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although a release occurred within the last year, the recent absence of development activity raises maintenance uncertainty.

Repo toolingcaution

The repository reports no build tooling and no security-scanning tooling. For a small JSON data package this is a modest transparency gap rather than a severe risk.