registry-url

Project backingcaution

The repository is owned by an individual rather than an organization, so continuity depends on a small maintainer base.

Release historycaution

The package has existed for about 12 years with 19 releases, but it has had no release in roughly 17 months. That is a maintenance concern, though the linked repository was pushed recently.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. The recent repository push is encouraging, but this still provides weak evidence of sustained development.

Repo toolingcaution

The repository reports no build tool and no security-scanning tool. For this small package that is a modest transparency and maintenance gap rather than a severe concern.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-confidence security findings, but both action references are unpinned. Missing a top-level permissions block is acceptable on its own, while unpinned actions remain a mild supply-chain hygiene concern.