@parcel/graph

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance warning, although the recent release history and push date provide some compensation.

Repo package mentioncaution

The repository name does not match @parcel/graph and its README does not mention the package. Although a monorepo sub-package can explain the name mismatch, the missing README reference leaves package ownership less transparent.

Security policycaution

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap, though the repository does use Dependabot and other build tooling.

Workflow auditcaution

All 49 analyzed action references are unpinned, creating avoidable workflow supply-chain drift. High-confidence secrets-inherit findings also broaden credential exposure; the template-injection findings have no dangerous trigger or checkout sink shown here, while the cache findings are low confidence.