@hapi/shot

Release historycaution

The package is mature at about 7 years old with 15 releases, but only one release in the last 12 months indicates a slow cadence. The latest release was published about 4 months ago, so this is a caution rather than abandonment evidence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That is a meaningful maintenance warning, though the recent registry release and non-archived repository provide some compensation.

Repo issue activitycaution

There is only one open issue and one open pull request, but neither issues nor pull requests were opened or closed in the last month. This supports the concern about low current activity.

Repo toolingcaution

The repository uses TypeScript build tooling, but no security scanning tools were detected. The missing scanning is a hygiene gap, not evidence that the package is unsafe by itself.

Workflow auditcaution

All one workflow was analyzed with no untrusted checkouts, injection findings, or audit findings. Its sole action reference is unpinned, which is a supply-chain hygiene weakness, while the absence of a top-level permissions block is acceptable on its own.