Sounds like they feel you're making useless work for them. Not saying they reacted well of course, but if they haven't published in five years then you have to

Sounds like they feel you're making useless work for them. Not saying they reacted well of course, but if they haven't published in five years then you have to imagine that improving their publishing flow could not be any lower of a priority. Obviously whatever is shipped five years ago was secure or someone would have noticed my now. I also think attestation is bullshit. It's what I would call "security theater" like paying $5 for a blue check mark. Whether a package has this particular check mark has almost nothing to do with whether its security practices are sufficient to keep you safe. At that point the attestation check mark actually harms security by welcoming complacency where there is still not sufficient operational safely to justify complacency.