The repository has active recent commits, tests, release notes, and a minimal dependency footprint. Its history is only hours old, all recent commits come from one person, and it lacks a security policy; the workflow audit also found a high-confidence template-injection pattern.
68%
Total Score
67
100
93
67
The repository is owned by an individual rather than an organization, so the single-contributor concentration is not visibly offset by organizational backing.
The package was first released only hours ago and has just two releases, so its maintenance record and maturity are not yet established.
All 16 recent commits came from one contributor, leaving maintenance dependent on a single person and increasing abandonment risk.
The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.
The complete audit found no untrusted checkouts, script injection, broad write permissions, or unpinned actions, but it did report one high-confidence template-injection finding, which is a workflow hygiene concern.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.