copy-to-clipboard

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry publisher reflects a genuinely thin maintainer base rather than organization publishing hygiene.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. The recent release and repository push partly compensate, but ongoing maintenance capacity remains uncertain.

Repo toolingcaution

The repository uses TypeScript, tsup, and npm scripts for builds, but no security-scanning tools were detected; the missing scanning is a modest transparency gap.

Security policycaution

No security policy was found in the repository, leaving vulnerability reporting expectations undocumented.

Workflow auditcaution

Both workflows were analyzed completely and have no untrusted checkout or script-injection findings, but all 9 action references are unpinned. The low-confidence cache-poisoning finding is hygiene rather than decisive evidence.