tree-changes

Release historycaution

The package has 32 releases over roughly eight years, but none in the last 12 months; the latest release was about 20 months ago. This is meaningful evidence of slowing maintenance, though the long release history provides some maturity.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. That does not prove abandonment, but it weakens confidence that issues or dependency changes will be addressed promptly.

Security policycaution

No repository security policy was found. This is a transparency and incident-response gap for a package with an otherwise identifiable source project.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection paths, and its two cache-poisoning findings have low confidence. However, all six action references are unpinned, which is a workflow hygiene weakness.