volar-service-html

Dangerous workflowscaution

One of five analyzed workflows contains a detected script-injection pattern in auto-version.yml, while no pull-request-target, workflow-run, or untrusted-checkout risks were found. The isolated workflow issue warrants caution but is partly offset by the absence of those higher-risk patterns.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern despite the recent registry release history, because the source project may be temporarily inactive or releases may not reflect current development.

Repo issue activitycaution

There were no new or closed issues in the last month and no pull requests merged, although two pull requests were opened. This indicates limited recent repository throughput and reinforces the maintenance concern.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene gap, not a severe risk on its own.

Security policycaution

No security policy was found in the repository. This weakens vulnerability-reporting transparency, though the package's provenance, licensing, and repository backing provide compensating health evidence.