ssh-remote-port-forward

Release historydanger

The package has had no release in nearly five years and no releases in the last 12 months, which is strong evidence of abandonment risk despite its four-release history.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, providing no evidence of current maintenance capacity.

Maintainerscaution

A single registry maintainer creates a thin support and continuity base; the repository is user-owned, so there is no organization backing shown to compensate for that concentration.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented for a package that handles SSH connections.

Workflow auditcaution

All seven analyzed action references are unpinned, and the publish workflow has high-confidence template-injection findings plus a trusted-publishing finding. The template findings lack a corroborating dangerous trigger, but the combined workflow hygiene still lowers confidence.