bentools/webpush-bundle

Maintainerscaution

Only one registry publishing maintainer is listed, which creates some publishing bus-factor concern. The long project history and recent releases partly compensate, and the repository owner is the same individual.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although a recent release shows some maintenance, the current lack of commit activity is a meaningful warning about responsiveness.

Repo toolingcaution

Composer is used for the build, but no security scanning tools were detected. This is a modest transparency and hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. Consumers have no documented channel or process for reporting vulnerabilities, which lowers project transparency.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injections, or audit findings. However, both of its two action references are unpinned, leaving them exposed to upstream changes.