nope-validator

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful sign of currently stalled maintenance despite a recent push timestamp.

Project backingcaution

The repository is owned by an individual rather than an organization, so the small two-account registry maintainer base has less visible organizational backing.

Repo issue activitycaution

Six pull requests were opened in the last month, but none were merged and no issues were closed, suggesting limited issue-resolution throughput.

Security policycaution

No security policy is present, leaving vulnerability-reporting guidance unclear; this is a transparency gap but not evidence of abandonment by itself.

Workflow auditcaution

All 21 analyzed action references are unpinned, creating avoidable workflow supply-chain drift. The audit also reports high-severity cache-poisoning findings only at low confidence and a high-confidence trusted-publishing finding, which warrants caution even without untrusted triggers or script injection.