@types/zxcvbn

Release historycaution

The package has existed since October 2017 but has had no release in the last 12 months, so its release cadence is slow; active repository work partly offsets abandonment concern.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package, creating some ownership ambiguity; the package README nevertheless points to the relevant DefinitelyTyped type directory.

Workflow auditcaution

All seven workflows were analyzed, all 25 action references are pinned, and no untrusted checkout or script-injection paths were found. Medium-confidence template-injection findings remain a hygiene concern, but no dangerous trigger or broad write permission compounds them.