chameleon-system/chameleon-base

Dependency profilecaution

The package declares 84 runtime dependencies, including many framework, extension, and third-party components. That breadth increases upgrade and transitive-maintenance overhead for consumers, although it is consistent with a large application core.

Repo commit activitycaution

The repository recorded no commits and no active maintainers during the last three months. The same-day release and strong registry cadence partly compensate, but the lack of recent source activity still weakens evidence of ongoing maintenance.

Security policycaution

No security policy was found in the repository. For a large core package, this is a transparency gap because consumers have no documented reporting path in the collected evidence.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 6 action references are unpinned, which leaves the workflow exposed to moving action versions, while the absence of a top-level permissions block is acceptable on its own.