ameax/ameax-json-import-api

Release historycaution

Only three releases exist, and none were published in the last 12 months; the latest release is over a year old. This is a meaningful maintenance concern, though the package is still relatively young.

Repo commit activitycaution

There were no commits from active maintainers in the last three months. The repository was pushed recently, but the absence of commit activity still weakens evidence of ongoing maintenance.

Security policycaution

The repository has no SECURITY.md or other published security policy. This is a transparency gap for a package that sends API data, though it does not by itself indicate abandonment.

Workflow auditcaution

All 12 action references are unpinned, and the audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. Three workflows grant top-level write access, but no untrusted checkout or script-injection sink was found, so this is workflow hygiene risk rather than a severe standalone threat.