k2gl/in-toto-attestation

Dangerous workflowscaution

One of three analyzed workflows uses pull_request_target, which can require elevated trust handling, but no untrusted checkout or script-injection patterns were detected. This is a workflow-security caution rather than a severe finding.

Maintainerscaution

Two registry accounts have publish access, which is a modest publishing base; this is a supporting caution because the repository activity signal shows only one active contributor rather than a broad maintainer group.

Project backingcaution

The repository is owned by the individual user k2gl, not an organization, so there is no organizational backing to offset the concentrated contributor activity.

Release historycaution

The package is only 96 days old with five releases, but releases have arrived at a moderate median interval of about 17 days and all five occurred within the last 12 months. This indicates active early maintenance while leaving limited long-term evidence.

Repo bus factorcaution

One contributor made all 19 commits in the last 3 months, giving the project a complete single-contributor concentration and a meaningful continuity risk; the repository owner is an individual rather than an organization.