castor/identifier

Maintainerscaution

One registry account publishes the package, which limits visible publishing redundancy. The repository is owned by an organization, so this is a moderate concern rather than evidence of unsupported ownership.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance concern for a package released during that period.

Repo popularitycaution

The repository has 6 stars, no forks, and no watchers, indicating a small external user and contributor base. Popularity is supporting evidence rather than a verdict, but it provides little backup for the lone maintainer.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented. This is a transparency gap, partly offset by the repository's tests, release notes, and visible source.

Workflow auditcaution

All 13 analyzed action references are unpinned, weakening build reproducibility and increasing exposure to changes in third-party actions. The audit found no untrusted checkouts, script injection, or high-severity findings, which keeps this from being severe.