arnautdev/filament-deploy-indicator

Project backingcaution

The repository and registry package are owned by the same individual account, and the source repository matches the package. This is transparent ownership, but it does not provide organization-level maintenance redundancy.

Repo bus factorcaution

All one recent commit came from a single contributor, so current maintenance is fully concentrated in one person. The repository owner is an individual rather than an organization, providing no shown handoff capacity.

Repo commit activitycaution

The repository recorded one commit from one active maintainer in the last three months. Recent activity exists, but the low volume provides limited evidence of sustained maintenance capacity.

Workflow auditcaution

All seven workflows were analyzed, but all 17 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects Dependabot auto-merge. The pull_request_target triggers have no untrusted checkout or script-injection sink, so they do not independently make this dangerous.