If you look at the repo it's not clear at all if there is an issue. It's certainly not a fork of a repo. It actually includes gemstash as a dependency [1] which is a really weird thing to do if it was actually a copy of gemstash.

https://github.com/GoogleCloudPlatform/google-cloud-gemserve...

If there is a lack of caution I think it's on @indirect's side.