package-json

Release historycaution

The package has a long history and 35 releases, but it has had no registry release in the last 12 months and the latest registry release was in July 2024, indicating a real release-cadence concern.

Repo bus factorcaution

All recent commit activity comes from one contributor, leaving maintenance dependent on a single person despite the repository remaining active.

Repo commit activitycaution

The repository had one commit in the last three months, showing some current maintenance but a fairly slow pace for a dependency.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout, injection, or high-severity findings, but both action references are unpinned, leaving avoidable workflow supply-chain hygiene risk.