carthage-software/ext-typst

Release historycaution

The package is young at 172 days with three releases and a median interval of about 86 days. That shows real release activity, though the limited history leaves maturity less established.

Repo toolingcaution

The project uses build tooling, but no security-scanning tools were detected. For a native extension this leaves a meaningful quality and maintenance gap.

Security policycaution

No repository security policy was found. This reduces disclosure transparency, although it does not by itself indicate abandonment.

Version stabilitycaution

Version 0.4.0 is not a prerelease, but it remains before a stable 1.0 major release. This is a modest maturity consideration rather than a severe stability concern.

Workflow auditcaution

All 33 analyzed action references are unpinned, and two workflows grant top-level write permissions, creating avoidable automation hygiene risk. The release workflow has high-confidence template-injection findings, but no untrusted checkout or script-injection trigger was reported; the low-confidence cache findings are hygiene only.