@microsoft/microsoft-graph-client

Release historydanger

The package has 49 releases over about 9 years with a historical median interval of about 20 days, but no releases in the last 12 months and none since September 2023. The long maintenance pause materially raises abandonment risk.

Repo commit activitydanger

The repository recorded 0 commits and 0 active maintainers during the last 3 months. This indicates currently absent development activity despite the repository remaining available.

Workflow auditdanger

All 3 workflows were analyzed and had no untrusted checkouts or script injection, but all 7 action references are unpinned and a high-confidence finding reports blanket app-token permissions in project-auto-add.yml. These are meaningful supply-chain and workflow-hygiene concerns.

Build provenancecaution

The release has no build attestation or trusted-publisher provenance. This weakens release transparency, although the repository and package otherwise show established project structure.

Security policycaution

The linked repository has no published security policy. For a client library handling authenticated API access, this reduces transparency about vulnerability reporting and response expectations.