@parcel/hash

Release historydanger

The package has 313 releases, but none in the last three years; the latest release was published over three years ago. This raises version-staleness and abandonment concerns despite the historically frequent cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, indicating a recent pause in development. This is partly offset by the repository still being active overall, but it remains a maintenance concern for this release.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @parcel/hash. The mismatch is understandable for a monorepo sub-package, but the lack of a README mention leaves package ownership somewhat less transparent.

Workflow auditcaution

All 49 analyzed action references are unpinned, and three workflows inherit secrets into reusable workflows; high-confidence template-injection findings are also present, though no untrusted checkout or script-injection path was identified. These are meaningful supply-chain hygiene weaknesses without evidence of an immediately dangerous trigger.