third-party-web

Maintainerscaution

Only one registry account has publish access, which creates a modest continuity risk. The linked repository is owned by the same individual and has a long release history, partially compensating for the narrow publisher base.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no demonstrated organizational continuity beyond the observed release and repository activity.

Repo commit activitycaution

The repository has had zero commits and zero active maintainers in the last three months, which is a meaningful maintenance concern. The concern is partly offset by a release today and two recently merged pull requests, but the contributor activity remains thin.

Security policycaution

No security policy is present in the repository, leaving vulnerability-reporting guidance unspecified. This is a transparency gap, but it is not by itself evidence that the package is unsafe to depend on.

Token permissionscaution

The workflow lacks a top-level permissions declaration, although it has job-level permissions and no top-level write permissions. The incomplete declaration is a minor workflow-hygiene concern.