run-applescript

Build provenancecaution

No build attestation or trusted-publisher provenance is available, limiting release-origin transparency, though this is not by itself evidence of an unhealthy package.

Release historycaution

This is a mature package released since 2014, but it has had no registry release in roughly a year and has a long median interval of about 392 days between releases.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, which is a meaningful sign of currently quiet maintenance despite the recent release history.

Token permissionscaution

The workflow does not declare top-level token permissions, so its permission scope is less explicit than recommended; no top-level write permissions were detected.