third-party-capital

Licensecaution

The artifact includes an Apache-2.0 license file and the repository also has a license, but the manifest declares ISC; this mismatch should be resolved before relying on the licensing metadata.

Release historycaution

The package has 42 releases since November 2022, but none in the last 12 months and the latest release was nearly two years ago, indicating stalled maintenance despite a strong earlier cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and raising abandonment risk.

Workflow auditcaution

The complete audit found no dangerous triggers or high-severity findings, but both analyzed workflow actions are unpinned, which weakens build reproducibility.