kelvinmo/jwkstool

Maintainerscaution

Only one registry maintainer is listed. The matching user-owned repository provides continuity, but the publishing base remains concentrated.

Project backingcaution

The registry namespace and repository are both owned by the same individual account, so the package has clear ownership but no organizational backing.

Release historycaution

The package has eight releases over about two years, but only one release in the last 12 months; the recent cadence is slower than its roughly 76-day historical median.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is consistent with the slower recent release cadence and raises maintenance risk.

Workflow auditcaution

All 20 analyzed action references are unpinned, weakening build reproducibility. The low-confidence cache-poisoning finding is hygiene evidence only and does not independently indicate a severe risk.