stubborn-fs

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers cannot independently verify how this release was produced. This is a transparency gap, not evidence of maliciousness.

Maintainerscaution

Only one registry publisher account is listed, leaving limited visible publishing redundancy. The linked repository is user-owned, so this is a real ownership concentration concern.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-publisher and limited-maintenance signals are not offset by visible organizational backing.

Release historycaution

The package has nine releases over about four years, but only one release in the last 12 months; the latest release was about 11 months before collection. This suggests slowing maintenance rather than abandonment.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Together with the infrequent recent release cadence, this points to limited current maintenance capacity.