websocket-extensions

Maintainerscaution

Only one registry account has publish access, which weakens publishing resilience. The repository is owned by an organization, so this is a smaller concern than it would be for an independently owned project.

Release historycaution

The package has had no releases in the last 12 months, and its latest release was in June 2020, more than 6 years before this assessment. This is meaningful maintenance risk, though the repository is not archived and was pushed in September 2023.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, indicating no current development activity. Its non-archived status provides some continuity but does not offset the recent inactivity.

Security policycaution

The repository has no security policy, reducing transparency around vulnerability reporting and maintenance expectations. This is a hygiene gap rather than evidence that the release is unsafe.

Workflow auditcaution

The sole workflow was fully analyzed with no untrusted checkout or script-injection findings, but both action references are unpinned and it installs a package outside a lockfile. These are limited workflow-reproducibility concerns, not severe risks.