@upstash/core-analytics

Release historydanger

The package has made no release in about 2 years and 3 months, despite 19 releases overall; its recent release cadence therefore provides weak evidence of ongoing maintenance.

Maintainerscaution

Six of eight publishing accounts use the upstash.com domain, which fits the organization-backed project; cahidarda (gmail.com) and joshtc (joshtriedcoding.com) are outside-domain accounts and add account-hygiene caution, not evidence of a thin maintenance team.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers over the last 3 months, consistent with the long gap since the latest release and raising abandonment risk.

Workflow auditcaution

The only workflow has both uses unpinned, installs a package outside the lockfile with high confidence, and uses long-lived registry publishing credentials; the low-confidence cache-poisoning finding is hygiene only, but the combined workflow issues lower supply-chain transparency.