pony-cause

Maintainerscaution

Only one registry account has publish access, creating a thin publishing base. The linked repository and release history provide some continuity, so this is a modest resilience concern rather than a severe risk.

Release historycaution

The package has 17 releases since September 2021, but its latest registry release was about two years ago and it had no releases in the last 12 months. This indicates slowed maintenance, although the release history is established.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. A recent repository push is evidence of some activity, but the observed commit window still suggests limited current maintenance.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, providing a defined build process. No security scanning tool was detected, which is a minor transparency gap but not decisive here.

Workflow auditcaution

All five analyzed workflows use unpinned actions, which weakens build reproducibility and update control. The workflows have read-only permissions, with no untrusted checkouts, injection findings, or audit failures, which limits the risk.