newman

Command-line companion utility for Postman

Latest 6.2.3

78%

Total Score

healthy

A mature, actively released CLI with strong project backing, but recent commits are sparse and workflow actions are entirely unpinned.

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher identity is present, reducing publication transparency, though this is a provenance gap rather than evidence of a bad release.

Dependency profile

The package has 21 runtime dependencies, which is a meaningful maintenance surface for a CLI, but the profile is not independently severe and is consistent with its feature set.

Maintainers

Seven accounts can publish and the primary domain is postman.com, but kamalaknn, abhijitkane, and codenirvana use gmail.com and shamasis uses shamasis.net; these are account-hygiene risks despite clear organizational backing.

Repo commit activity

Only two commits were recorded in the last three months, indicating limited recent implementation activity despite the recent release and pull-request activity.

Workflow audit

Both workflows were fully analyzed with no audit findings, no untrusted checkouts, and no write-wide permissions. However, all eight action references are unpinned, leaving a reproducibility and action-integrity gap.