node-releases

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last 3 months, which is a maintenance concern. However, the package's frequent releases and recent repository push provide compensating evidence for its automated data-update model.

Security policycaution

No repository security policy was found. This is a transparency gap, but it is modest for a small data package with limited runtime behavior.

Workflow auditcaution

The single workflow is fully analyzed with no untrusted checkout, script injection, or auditor findings, but it grants top-level write permissions and both action references are unpinned. Those are workflow hygiene risks without evidence of an exploitable untrusted path.