envinfo

Project backingcaution

The repository is owned by an individual rather than an organization, so the small maintainer base offers less visible institutional backing if maintenance slows.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance concern despite the recent registry releases.

Repo toolingcaution

The repository uses established build tools, but no security scanning tools were detected, leaving security hygiene less mature than its build process.

Security policycaution

No repository security policy was found, reducing transparency about how vulnerabilities are reported and handled.

Workflow auditcaution

All 9 action references are unpinned and one workflow has top-level write permissions. The high-severity cache-poisoning finding is low confidence, so it is hygiene rather than a standalone severe risk.