nanotar

Repo commit activitycaution

The repository recorded no commits and no active maintainers during the last three months. A recent push and release provide some compensation, but the short-term development pause still raises maintenance concern.

Repo toolingcaution

The project uses TypeScript and npm-based build tooling, but no security scanning tools were detected. This is a modest transparency and maintenance gap.

Security policycaution

No repository security policy was found. That weakens disclosure transparency, although it does not by itself indicate abandonment.

Workflow auditcaution

Both workflows were fully analyzed with no high- or medium-severity findings and no untrusted checkout or script-injection paths. However, four of five action references are unpinned, and both workflows install packages outside a lockfile, creating a workflow hygiene concern.