callsites

Project backingcaution

The repository is owned by an individual rather than an organization, so institutional backing is limited; this is partly offset by the matching source repository and the package's long history.

Release historycaution

The package has existed for over 12 years with 10 releases, but has had no registry release in the last 12 months; this indicates a slow cadence rather than clear abandonment.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, which weakens evidence of ongoing maintenance; the recent repository push is some counterevidence but does not establish sustained activity.

Repo toolingcaution

No build tool or security scanning tool was detected. For this small, dependency-free package this is a hygiene gap, not evidence that the release is unfit.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-confidence audit findings, and it has no dangerous trigger or top-level write permissions. Both of its action references are unpinned, creating a modest supply-chain and reproducibility concern.