koa-compose

Release historycaution

The latest release was published about six years ago, with no releases in the past 12 months. The package has a long history and 16 releases, but the stale registry release lowers confidence in current maintenance.

Repo commit activitycaution

The repository recorded no commits or active maintainers in the past three months. Its unarchived state and recent push provide some context, but do not offset the lack of recent commit activity entirely.

Workflow auditcaution

All three analyzed action references are unpinned, which weakens build reproducibility. The audit found no dangerous triggers, untrusted checkouts, script injection, or security findings, so this is a hygiene caution rather than a severe risk.