json-schema-typed

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer represents a thin visible maintainer base and limited redundancy.

Repo commit activitycaution

No commits and no active maintainers were recorded in the last 3 months. This is a maintenance warning, though the same period includes a current release and repository push, so it is not evidence of abandonment by itself.

Security policycaution

No repository security policy was found. This is a transparency gap, but it is less significant for a small type-definition package with no runtime dependencies.

Workflow auditcaution

Both workflows were analyzed, but all 6 action references are unpinned, one workflow grants top-level write permissions, and a high-confidence low-severity audit found an ad hoc package install. The cache-poisoning finding has low confidence and is hygiene rather than a decisive risk.