@dual-bundle/import-meta-resolve

Release historycaution

The package has four releases over about two and a half years, but none in the last 12 months; the latest release is over a year old, which raises maintenance risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the past three months, providing no recent evidence of ongoing maintenance.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance unclear; this is a transparency gap rather than evidence of unsafe code.

Workflow auditcaution

All three workflows were analyzed, but all seven action references are unpinned and one release workflow has broad top-level write permissions. A low-confidence cache-poisoning finding adds workflow hygiene concern, without an untrusted trigger or checkout sink.