cable8mm/nano-ai

Registry deprecationdanger

Packagist marks the entire package as abandoned, with no replacement named. This is a direct warning that ongoing maintenance should not be expected.

Repository archiveddanger

The linked repository is archived, despite being pushed recently. An archived source project is a severe abandonment risk for a dependency.

Repo bus factorcaution

One contributor made all 11 commits in the last three months, giving the project no demonstrated contributor redundancy. The repository owner is an individual, so there is no organization backing to offset this concentration.

Security policycaution

The repository has no security policy. For a small SDK this is a transparency gap, though it is outweighed by the package's stronger abandonment signals.

Workflow auditcaution

All 9 analyzed action references are unpinned, and the audit found one high-confidence template-injection issue in the changelog workflow. No untrusted checkout or dangerous trigger was reported, so this remains a workflow hygiene concern rather than a standalone severe risk.