arvi/unit-conversion

Release historycaution

The package has only two releases, both on May 25, 2022, with no releases in the last 12 months. This indicates very limited ongoing maintenance for a package now more than four years old.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing the absence of recent registry releases. This leaves future fixes and compatibility updates uncertain.

Security policycaution

The linked repository has no security policy. For a small utility this is a transparency gap, though the package is licensed, documented, and has no reported registry deprecation.

Workflow auditcaution

All 8 analyzed action references are unpinned, and the audit found high-confidence bot-condition and unpinned-container-image issues. The pull_request_target workflow has no untrusted checkout or script injection, so these are workflow hygiene concerns rather than a severe dependency risk.