wsl-utils

Build provenancecaution

No build attestation or trusted-publishing provenance is present, leaving publication origin less verifiable even though this does not by itself indicate an unhealthy project.

Maintainerscaution

One registry publisher is listed, which limits publishing redundancy, but the linked repository identifies the same active owner and other activity signals show ongoing maintenance.

Repo bus factorcaution

One contributor made all three recent commits, creating a concentrated maintenance risk; the repository is user-owned rather than organization-backed, so there is no shown handoff buffer.

Repo toolingcaution

TypeScript is used as a build tool, but no security scanning tools were detected, leaving a modest security-process gap.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, injection findings, or write-wide tokens. Both action references are unpinned, which is a supply-chain hygiene weakness.