shasum-object

Build provenancecaution

No build attestation or trusted-publisher provenance is available, reducing publication transparency, although this is not evidence that the release is unsafe by itself.

Maintainerscaution

Only one registry publisher is listed. That does not prove poor maintenance, but it indicates a thin publishing base for a user-owned project.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-maintainer and limited-activity concerns are not offset by visible organizational backing.

Release historycaution

The package has only two releases across about 6 years and no releases in the last 12 months, indicating a very slow maintenance cadence even though the latest release is recent in the collected history.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. The repository is not archived, but the recent activity still points to limited ongoing maintenance.