pupa

Project backingcaution

The source repository is owned by an identified individual rather than an organization; this is a smaller backing model, but the matching repository and other health signals provide compensation.

Release historycaution

The package has existed for about 9 years with 10 releases, but no registry releases occurred in the last 12 months, indicating a slow cadence for this small mature library.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last 3 months; the recent repository push provides some compensation but does not establish sustained activity.

Workflow auditcaution

The workflow audit completed fully with no dangerous triggers, untrusted checkouts, injection findings, or high-severity issues. Both of its action references are unpinned, creating a minor supply-chain reproducibility concern.