byjg/fonemabr

Project backingcaution

The registry namespace and repository owner match, but the owner is an individual user rather than an organization. This does not establish broad organizational maintenance capacity.

Release historycaution

The package has existed for over eight years with five releases, but only one release in the last 12 months and a median interval of about 345 days indicate a slow cadence. This is a maintenance caution rather than abandonment by itself.

Repo commit activitycaution

No commits and no active maintainers were recorded during the last three months. That weakens evidence of ongoing maintenance, although the repository is not archived.

Repo popularitycaution

The repository has only 2 stars, 0 forks, and 1 watcher. Popularity is supporting evidence rather than a verdict, but these numbers provide little evidence of a broad maintainer or user community.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection findings, and it scopes permissions at the job level. However, all 4 action references are unpinned and the audit found a high-confidence medium-severity secrets-inherit issue, creating a CI hygiene caution.