d3-format

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. This is a maintenance warning, although the recent registry releases provide some compensating evidence.

Repo toolingcaution

The project uses Rollup and Vitest, showing established build and test tooling, but no security scanning tools were detected. The missing scanning is a minor hygiene gap rather than evidence of abandonment.

Security policycaution

No repository security policy was detected. That reduces transparency for reporting vulnerabilities, though it does not by itself indicate that the package is unsafe to depend on.

Workflow auditcaution

All four analyzed action references are unpinned, and the publish workflow has top-level write permissions. The audit also reported a low-confidence cache-poisoning finding; with no untrusted checkout or script-injection paths, these are workflow-hygiene concerns rather than severe evidence.