sumchecker

Release historycaution

The latest registry release was nearly seven years ago, with no releases in the last 12 months. The package has a long history, but this strongly lowers confidence that the published release is actively maintained.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Combined with the stale release history, this is a meaningful maintenance concern.

Workflow auditcaution

All nine analyzed action references are unpinned, which weakens build reproducibility. The high-confidence bot-condition finding is a workflow hygiene concern, while the cache-poisoning findings are low confidence and do not independently establish severe risk.