78%
Total Score
healthy
Healthy release, with active development and verified publishing outweighing contributor concentration and unclear package-to-repository linkage.
Only one registry publishing account is listed, creating publishing continuity risk; the organization-owned repository and active project provide some compensation.
One contributor made about 93% of recent commits, leaving substantial continuity risk despite 9 active contributors and organization backing.
The repository name does not match this package and its README does not mention the package, so the linkage is unclear even though the package appears alongside related project artifacts.
Version 0.13.0 is not yet at a stable major version, which implies some API maturity risk, although it is not a prerelease and recent releases are stable.
All 7 workflows were analyzed, use read-only permissions, and pin all 33 action references. The low-confidence cache-poisoning finding is limited hygiene evidence, while trusted publishing is a caution under the audit rules.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.