is-path-inside

Maintainerscaution

Only one registry account has publish access. This is consistent with the individual-owned repository, but it leaves limited publishing redundancy.

Project backingcaution

The repository is owned by an individual rather than an organization, so continuity depends on a relatively narrow maintainer base.

Release historycaution

The package has existed since 2014 with ten releases, but it has had no registry release in the last 12 months and its latest release was in May 2021, indicating a slow or paused release cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, leaving current maintenance capacity uncertain and reinforcing the old-release concern.

Token permissionscaution

The workflow does not declare top-level token permissions, so its permission boundaries are less explicit than recommended. No workflow requests top-level write access, which limits the severity of this hygiene gap.