liftoff

Build provenancecaution

No build attestation or trusted-publisher identity is provided, leaving the relationship between the published artifact and its source less independently verifiable.

Release historycaution

The package has 60 releases over roughly 12 years, but none in the last 12 months; its latest release was over a year ago, indicating slowed maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, consistent with the release history showing no release in the last year and raising abandonment concerns.

Repo toolingcaution

The repository uses a build tool, but no security scanning tools were detected; this is a modest transparency and hygiene gap rather than evidence of unfitness.

Workflow auditcaution

Both workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 7 action references are unpinned, so workflow dependencies can change unexpectedly.