@parcel/package-manager

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers over the last three months, a significant recent-maintenance warning. The package’s release history and recent repository push provide some counterweight but do not remove the concern.

Workflow auditdanger

All six workflows were analyzed without failures and no untrusted checkouts or script-injection sinks were found. However, all 49 action references are unpinned, and high-confidence template-injection and secrets-inherit findings weaken release-workflow hygiene; the low-confidence cache findings add little weight.

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency weakness, not evidence that the release is unsafe.

Dependency profilecaution

Nine runtime dependencies, including several related Parcel packages and build tooling, create a meaningful dependency surface. The profile is coherent for a package-manager component but increases transitive maintenance exposure.

Repo issue activitycaution

Issues and pull requests remain active, with new issues and pull requests in the last month, but no pull requests were merged during that period. This supports ongoing attention while showing limited recent throughput.