chartjs-plugin-annotation

Release historycaution

The package has existed since 2016 with 37 releases and historically released about every 22 days, but its latest release was nearly two years ago and there were no releases in the last 12 months.

Repo commit activitycaution

No commits and no active maintainers were recorded in the past three months, a meaningful warning about current maintenance capacity.

Repo toolingcaution

The repository uses TypeScript, Rollup, and npm scripts, showing a defined build process, but no security scanning tools were detected.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations unclear.

Workflow auditcaution

All 22 analyzed action references are unpinned, and the publish workflow installs a package outside a lockfile; these weaken reproducibility. The reported cache-poisoning findings have low confidence, while trusted-publishing findings are informational, so they do not independently establish severe risk.