axp-dev/ya-metrika

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-contributor concentration is a meaningful continuity risk.

Release historycaution

The package has released only seven times since 2017 and had no registry release in the last 12 months, which is a maintenance concern. Recent repository activity partly offsets the stale registry cadence.

Repo bus factorcaution

All 16 recent commits came from one contributor, so maintenance depends heavily on a single person.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All seven analyzed action references are unpinned, weakening build reproducibility. The pull_request_target workflow has no untrusted checkout or script-injection findings, and no higher-risk audit findings were reported.