astring

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can increase workflow risk when handling untrusted pull requests, although no untrusted checkout or script injection was detected.

Lifecycle scriptscaution

A prepare install-time script introduces some supply-chain and installation complexity, although the package has no runtime dependencies and the repository shows conventional build tooling.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single registry maintainer reflects a genuinely thin apparent ownership base rather than normal organization publishing hygiene.

Release historycaution

The project is mature, with 84 releases since 2015, but it has made no registry release in about two years. That slows confidence that bugs and platform changes will receive attention.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months, consistent with the roughly two-year release gap and raising abandonment risk.