@ucast/core

Release historycaution

The package has existed for over six years with 22 releases, but only one release in the last 12 months indicates a slower release cadence.

Repo bus factorcaution

All three recent commits came from one contributor, leaving maintenance concentrated in a single person without organizational backing.

Repo commit activitycaution

Only three commits were made in the last three months, so maintenance activity is present but thin for a package developers may depend on.

Repo toolingcaution

TypeScript build tooling is present, but no security scanning tools were detected, leaving a modest repository-hygiene gap.

Workflow auditcaution

Both workflows were analyzed without untrusted checkouts, script injection, or audit findings, and one scopes permissions at job level. However, all four action references are unpinned, weakening supply-chain reproducibility.