The project includes a clear MIT license, substantial documentation, a changelog, and active security tooling. Workflow dependencies are entirely unpinned, and registry history is too short to establish dependable maintenance.
62%
Total Score
50
83
50
This is the only release, published 114 days ago, so there is too little release history to demonstrate sustained maintenance or stability.
The repository recorded zero commits and zero active maintainers in the last three months, a meaningful maintenance concern even though it was pushed more recently.
Nine pull requests are open and none were merged in the last month, suggesting limited demonstrated throughput despite three newly opened pull requests.
Version v0.1.0 is an early non-stable-major release, which signals a less mature compatibility promise despite not being marked as a prerelease.
All 15 action references are unpinned, weakening build reproducibility, and one workflow has top-level write permissions. The low-confidence cache-poisoning finding is hygiene only; trusted publishing is a genuine caution.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.