vfile

Dangerous workflowscaution

One of two workflows uses pull_request_target, which warrants workflow review because it can run with elevated repository context, though no untrusted checkout or script-injection pattern was detected.

Release historycaution

The package has a long history with 43 releases, but it has had no release in about two years, which lowers confidence that new fixes will arrive promptly.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign of currently quiet maintenance.

Repo issue activitycaution

There are no open issues or pull requests and no recent issue activity; this may reflect stability, but it provides little evidence of active ongoing maintenance.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected, leaving a modest process gap.