otpauth

Maintainerscaution

Only one registry account has publish access, creating concentration risk, although the linked repository is user-owned and the package has a long release history and recent publication.

Project backingcaution

The source repository is owned by a named individual rather than an organization, so the single registry maintainer represents genuine project-bus-factor exposure rather than normal organization publishing hygiene.

Repo commit activitycaution

No commits or active maintainers were recorded during the last 3 months, which is a maintenance slowdown and the clearest abandonment concern; the recent release, push, and merged pull request partially offset it.