sync-fetch

Build provenancecaution

No build attestation or trusted-publisher provenance is present, limiting publication transparency, but this is a transparency gap rather than evidence of abandonment.

Maintainerscaution

Only one registry account has publish access, creating a continuity concern, though repository activity shows that this maintainer is currently active.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no organizational backing to offset the narrow maintainer base.

Repo bus factorcaution

All 2 recent commits came from one contributor, so the project has a low bus factor and could become difficult to maintain if that contributor stops.

Repo commit activitycaution

There were 2 commits in the last 3 months, showing recent maintenance, though the activity is light and concentrated in one active maintainer.