defu

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months. This is a meaningful maintenance concern, though it is partly offset by the recent release and repository push activity.

Repo toolingcaution

The repository uses TypeScript and a build tool, but no security scanning tools were detected. This is a modest transparency and supply-chain hygiene gap.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance unclear. The gap lowers transparency but is not by itself evidence that the package is unsafe.

Token permissionscaution

The only workflow lacks top-level token permissions. No write permissions were detected, but explicitly restricting permissions would provide stronger workflow hardening.