detect-indent

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent. This is a supply-chain hygiene gap, not evidence that the release is unsafe.

Release historycaution

The package is mature, with releases since 2013 and 18 releases overall, but it has had no registry release in the last 12 months. This suggests slowing maintenance rather than abandonment by itself.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, despite a February 2026 push. This is the main maintenance concern for a new dependency.

Workflow auditcaution

The single workflow was fully analyzed with no high- or medium-severity findings and no untrusted checkout or injection sinks. However, both action references are unpinned, which weakens build reproducibility and merits a hygiene caution.