aflorea4/filament-navigation

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, which warrants review because it can run with elevated repository context; no untrusted checkout or script-injection patterns were detected.

Maintainerscaution

Two registry maintainers provide some publishing redundancy. The linked project is user-owned rather than organization-backed, so the small maintainer base remains a modest continuity consideration.

Release historycaution

There have been 12 releases in about 233 days, showing ongoing publication, but the median interval is only about 15 minutes, suggesting unusually compressed release bursts rather than a clearly measured cadence.

Repo popularitycaution

The repository has zero stars, forks, and watchers. This limits independent evidence of adoption and review, although popularity is supporting evidence rather than a requirement for a small maintained package.

Token permissionscaution

Four of five workflows omit top-level token permissions, and the Dependabot auto-merge workflow has top-level write access. Explicit least-privilege permissions would improve workflow hygiene.