@rollup/plugin-yaml

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance concern despite the recent release and repository push.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, creating some ownership ambiguity; the organization-backed monorepo context partly compensates for that concern.

Repo toolingcaution

The project uses Rollup and TypeScript, but no security-scanning tools were detected; this is a modest transparency and hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented.

Workflow auditcaution

All 12 analyzed action references are unpinned, and the audit found high-confidence template-injection patterns; however, there were no untrusted checkouts or script-injection findings, so this is workflow hygiene risk rather than a severe dependency verdict.