local-pkg

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last three months, despite a recent registry release. This is a meaningful maintenance concern, though the release history shows the project is not abandoned outright.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts, showing an established build and test setup. It has no detected security-scanning tools, which is a minor additional hygiene gap.

Security policycaution

The repository has no security policy, so there is no documented path for reporting vulnerabilities or coordinating fixes. This is a transparency and response-readiness gap.

Workflow auditcaution

Both workflows were analyzed successfully and no dangerous triggers, untrusted checkouts, script injection, or audit findings were reported. However, both action references are unpinned, which leaves the build dependent on moving action revisions.