csarcrr/invoicing-integration

Maintainerscaution

Only one registry maintainer is listed, leaving limited publishing redundancy; the frequent release history provides some compensation but does not remove the bus-factor concern.

Project backingcaution

The package is backed by an individual repository owner rather than an organization, so the single-maintainer limitation is more consequential than it would be for an organization-backed project.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful sign that maintenance may have slowed after the recent releases.

Repo popularitycaution

The repository has five stars and no forks, indicating limited adoption; this is supporting context rather than a health verdict, especially alongside its release history.

Workflow auditcaution

All four workflows were analyzed with no reported audit findings or untrusted checkouts, but all nine action references are unpinned and two workflows grant top-level write permissions. These are hygiene and token-scope concerns, not severe risks on their own.