@hexagon/base64

Maintainerscaution

Only one registry account has publish access. The matching repository owner provides some continuity, but a single publisher leaves little redundancy if maintenance stops.

Project backingcaution

The registry namespace and repository owner align, but the repository is owned by a user rather than an organization, so there is limited evidence of institutional backing.

Release historycaution

The package has 33 releases since December 2021, but none in the last 12 months and the latest was in October 2024. That long release gap lowers confidence in ongoing maintenance.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Although the repository was pushed in November 2025, the recent inactivity still weakens evidence of active maintenance.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts or script injections, and one scopes permissions at job level. However, all 9 action references are unpinned and the audit identified trusted publishing that uses a long-lived token, so workflow supply-chain hygiene remains a concern.