create-hash

Dangerous workflowscaution

Two of six workflows use pull_request_target, which warrants review because that trigger can run with elevated repository context. No untrusted checkouts or script-injection patterns were detected, providing partial compensation.

Dependency profilecaution

The package has five runtime dependencies, a moderate dependency surface for a small hashing library. This adds some maintenance exposure but is not severe on its own.

Release historycaution

The latest registry release was published on April 11, 2018, with no releases in the last 12 months. This is a substantial maintenance concern for a dependency, even though the package has a long history and eight releases.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent push timestamp does not compensate for the observed lack of current commit activity, leaving maintenance capacity uncertain.

Repo toolingcaution

No build tooling or security scanning tools were detected. For this small JavaScript package the build gap is limited, but the absence of security scanning reduces repository hygiene.