a909m/filament-generate-helpers

Release historycaution

The package has five releases, but none in the last 12 months; the latest release is substantially older than the assessment. This is a meaningful maintenance concern for a library dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. Although the repository is not archived, the lack of recent activity raises abandonment risk.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, though the package does provide other project documentation and security tooling.

Workflow auditcaution

All 12 analyzed action references are unpinned, and the audit found one high-confidence bot-conditions issue in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, limiting the concern to workflow hygiene.