run-con

Build provenancecaution

No build provenance attestation or trusted-publisher identity is present, reducing publication transparency, though this is not by itself evidence of an unsafe release.

Maintainerscaution

Only one registry maintainer account is listed, and the repository is user-owned rather than organization-backed, leaving limited publishing redundancy.

Repo bus factorcaution

All recent commits come from one contributor, so maintenance depends entirely on that person and has no demonstrated handoff capacity.

Repo commit activitycaution

Only one commit was recorded in the last three months from one active maintainer, showing current maintenance but a very low activity level.

Repo issue activitycaution

There are open issues and pull requests, and one new pull request in the last month, but none were merged during that period; this is a mild sign of limited project throughput.