p-waterfall

Project backingcaution

The repository is owned by a user account rather than an organization, so the single registry maintainer does not benefit from visible organizational backing; the repository identity is otherwise consistent.

Release historycaution

The package has five releases since November 2016, but none in the last 12 months and the latest registry release was over five years ago; this materially raises maintenance risk.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, weakening evidence of active maintenance; the recent repository push partly offsets but does not remove this concern.

Repo toolingcaution

The repository uses TypeScript build tooling, but no security scanning tools were detected; this is a modest hygiene gap, not a standalone dependency risk.

Workflow auditcaution

The workflow audit completed cleanly with no untrusted checkouts, injection findings, or high-confidence audit issues. Both action references are unpinned, which is a supply-chain hygiene weakness, but no dangerous trigger or token configuration compounds it.