anamarijapapic/weight-conversions

Release historydanger

The package has had only three releases, all concentrated between July 3 and July 5, 2023, with no releases in the last 12 months; this is strong evidence of abandonment risk.

Repo commit activitydanger

There were zero commits and zero active maintainers in the last three months, consistent with the repository's last push in October 2023 and indicating prolonged inactivity.

Workflow auditdanger

All 8 action references are unpinned, and high-confidence findings identify spoofable bot conditions and an unpinned container image. The pull_request_target workflow has no untrusted checkout or script-injection finding, so these remain serious workflow hygiene risks rather than proof of direct compromise.

Maintainerscaution

Only one registry maintainer is listed, and the repository is owned by an individual rather than an organization; this leaves limited evidence of continuity if that maintainer stops contributing.

Project backingcaution

The repository and registry are owned by the same individual, confirming ownership alignment but providing no organizational backing to compensate for the thin maintainer base.