before-after-hook

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-publisher model provides limited visible backing.

Release historycaution

The package has 21 releases since 2016, but none in the last 12 months; the long pause raises maintenance concern despite a previously regular median interval of about 32 days.

Repo commit activitycaution

No commits and no active maintainers were recorded during the last three months, a meaningful maintenance warning even though the repository was pushed recently.

Repo toolingcaution

The project uses TypeScript for its build, but no security scanning tools were detected; this is a modest transparency gap rather than a severe risk.

Workflow auditcaution

All three workflows were analyzed with no high- or medium-confidence audit findings and no untrusted checkout or script-injection paths. However, all 12 action references are unpinned, which weakens build reproducibility; missing top-level permissions blocks are not a concern by themselves.