MIT licensing, npm provenance, repository tests, and a readme make the package transparent to consume. Its organization-backed project has strong workflow hygiene, but the recent maintenance pause and broad GitHub App token warrant pinning this exact release.
62%
Total Score
75
93
75
100
The package has 40 releases over 545 days, but only 3 releases in the last 12 months; this indicates a slower recent cadence rather than abandonment by itself.
The repository recorded 0 commits and 0 active maintainers in the last three months, a meaningful maintenance warning despite a recent push observed separately.
All 9 workflows were analyzed, use read-only permissions, and pin all 46 action references. However, a high-confidence finding reports a GitHub App token inheriting blanket installation permissions, while the low-severity ad hoc package install is a smaller hygiene concern.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.