@octokit/plugin-rest-endpoint-methods

Repo bus factorcaution

All commits in the last 3 months came from one contributor. The organization-owned repository provides handoff capacity, but no second active contributor is shown in this period.

Repo commit activitycaution

Only one commit was recorded in the last 3 months, indicating limited recent source activity. Recent releases and pull-request activity partly offset this, but they do not fully remove the maintenance concern.

Workflow auditcaution

All seven workflows were analyzed, but all 21 action references are unpinned, and three high-confidence findings report blanket GitHub App token permissions; one workflow also installs a package outside a lockfile. The pull_request_target triggers had no reported untrusted checkout or script-injection sink, so these are workflow-hygiene concerns rather than standalone critical risks.