youch-core

Release historycaution

The package has 12 releases over about 23 months, but none in the last 12 months; that extended release gap raises maintenance uncertainty.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last 3 months, which is a meaningful sign of slowed maintenance.

Repo toolingcaution

The project uses TypeScript, tsup, and npm scripts, but no security-scanning tooling was detected; this modestly reduces repository assurance.

Workflow auditcaution

All 8 analyzed action references are unpinned, and 2 workflows grant top-level write permissions. No untrusted checkouts, injection sinks, or audit findings were reported, so this is a hygiene concern rather than a severe risk.