safe-execa

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing publication transparency; this is a transparency gap rather than evidence of compromise.

Release historycaution

Nine releases over about five years and only one release in the last year indicate a slow cadence, though the latest release is recent enough to avoid an abandonment verdict.

Repo bus factorcaution

One contributor made all recent commits, creating a fragile maintenance dependency; the repository is user-owned rather than organization-backed.

Repo commit activitycaution

Two commits in the last three months show some current activity, but the low volume indicates limited maintenance capacity.

Repo package mentioncaution

The repository name does not match safe-execa and its README does not mention the package, so the link does not clearly establish that this repository is the package's source.