byjg/cache-engine

Project backingcaution

The registry namespace and repository owner match, and the repository is maintained by the named individual rather than an organization. That provides ownership consistency, though the individual ownership leaves a narrower visible maintainer base.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which is a maintenance warning. Recent release and push activity provide some compensation, so this is caution rather than danger.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts or script-injection findings, but all four action references are unpinned and the audit found two high-confidence unpinned container-image findings. This is a reproducibility and CI supply-chain hygiene gap, not a severe dependency-health failure by itself.