date-format

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no visible organizational backing to offset the thin maintenance activity.

Release historycaution

The package has 23 releases and a history dating to 2013, but its latest release was in September 2022 with no releases in the last 12 months. That long pause raises maintenance uncertainty for new dependencies.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months. Combined with the long registry release pause, this makes future fixes and updates uncertain.

Security policycaution

The repository has no published security policy. This reduces transparency about vulnerability reporting, though the package's small, dependency-free design partly limits the concern.

Workflow auditcaution

All 10 analyzed action references are unpinned, and the audit found a high-confidence template-injection pattern plus trusted publishing with long-lived credentials. No untrusted checkout or script-injection trigger was found, so these are workflow hygiene and publishing risks rather than a standalone critical failure.