@edge-runtime/format

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, leaving publication origin less transparent than it could be.

Release historycaution

The package has 36 releases over roughly four years, but there have been no registry releases in the last 12 months and the latest release was about 21 months ago, indicating a meaningful maintenance gap.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a strong sign of currently low maintenance activity despite a recent push timestamp.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, and 28 issues plus 24 pull requests remain open; this suggests limited recent project activity.

Workflow auditcaution

All three workflows were analyzed, but all nine action references are unpinned and the audit found a high-confidence template-injection issue plus one script-injection finding. Low-confidence cache findings are hygiene concerns, while the audit otherwise found no untrusted checkout or broad top-level write permission.