structured-source

Release historycaution

The package has existed for over 11 years but has only seven releases, and the latest registry release was over three years ago. This is a meaningful maintenance concern, partly offset by the linked repository being recently pushed.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Although the repository was pushed recently, the lack of recent commit activity limits evidence of ongoing maintenance.

Repo toolingcaution

The project uses TypeScript and npm scripts, but no security-scanning tool was detected. This is a modest transparency and hygiene gap rather than a severe dependency risk.

Workflow auditcaution

The only workflow was fully analyzed with no audit findings or untrusted execution paths. Both of its two action references are unpinned, leaving avoidable version-drift and takeover exposure.