sshpk

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have limited evidence connecting the published artifact to its source build. This is a supply-chain transparency gap, not a malware verdict.

Release historycaution

The project has 51 releases over more than 11 years, but no registry release occurred in the last 12 months and version 1.18.0 was published nearly three years ago. This indicates meaningful maintenance staleness for a dependency.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which is a concrete sign of currently limited maintenance capacity. The repository's recent push prevents this from being evidence of abandonment on its own.

Repo issue activitycaution

There are 24 open issues and 6 open pull requests, with no issues or pull requests closed in the last month. This suggests unresolved maintenance demand, though the short observation window limits the severity.

Repo toolingcaution

The repository uses Make for builds, but no security scanning tool was detected. The missing scanning is a maintenance and transparency gap, though it is not evidence that the package is unsafe by itself.