ssh2-sftp-client

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, leaving release origin less transparent despite the otherwise established project history.

Maintainerscaution

One registry publisher creates a bus-factor concern, although the matching source repository and recent release provide some compensating evidence.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. The same-day release and repository push show recent activity, but the short-term contributor inactivity still warrants caution.

Repo toolingcaution

The repository reports no build tool and no security-scanning tools. This is a meaningful hygiene gap, though the package remains small and its source and tests are visible.

Security policycaution

No repository security policy is present, reducing transparency around vulnerability reporting and response expectations.