@nodelib/fs.scandir

Release historycaution

The package has a mature history with 19 releases since May 2018, but its latest release was in December 2024 and there were no releases in the last 12 months. That slower cadence lowers confidence in ongoing maintenance.

Repo commit activitycaution

There were no commits and no active maintainers in the three months before collection. Although the repository was pushed more recently, the measured commit window still indicates limited current development activity.

Security policycaution

The repository has no security policy. This is a transparency gap, but it is a smaller concern because CodeQL scanning is present.

Workflow auditcaution

All 8 analyzed action references are unpinned, which weakens workflow reproducibility. The two reported cache-poisoning findings have low confidence and therefore remain hygiene concerns rather than severe evidence; the audit itself completed fully.