@rollup/plugin-commonjs

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance warning, although the release history shows continued publishing.

Repo issue activitycaution

Only one issue was opened and no issues or pull requests were closed or merged in the last month, suggesting limited recent repository activity alongside the commit gap.

Repo toolingcaution

The repository uses Rollup and TypeScript build tooling, but no security-scanning tools were detected. The missing scanning is a hygiene gap rather than a standalone severe risk.

Security policycaution

No repository security policy was found, reducing transparency for vulnerability reporting and response expectations.

Workflow auditcaution

All 12 action references are unpinned and one workflow has top-level write permissions, creating workflow-hygiene concerns. High-confidence template-injection findings are present, but without untrusted triggers or checkout sinks they remain hygiene issues rather than standalone severe risks.