Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
68%
Total Score
caution
Recent maintenance is quiet and CI has broad, unpinned workflow access despite strong release and organization backing.
The package has 36 releases over about 2 years and released this version recently, but only 2 releases occurred in the last 12 months, indicating a slower current cadence.
The repository recorded zero commits and zero active maintainers over the last 3 months. The same-day release and push provide some compensating evidence, but recent maintenance capacity still looks thin.
The repository has only 7 stars and 3 forks, indicating limited public adoption, but popularity is supporting evidence and does not outweigh the organization backing and release activity.
All 8 workflows were analyzed, but all 20 action references are unpinned and four high-confidence findings show GitHub app tokens inheriting blanket installation permissions. Two workflows also grant top-level write access, although no untrusted checkout or script-injection sink was found.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.