cspivack/faker-baseball

Maintainerscaution

The package has one registry maintainer, which is a thin publishing base for ongoing support. The linked repository is user-owned, so this is not organization-backed redundancy.

Release historycaution

This is the only release, published over four years ago, with no releases in the last 12 months. The complete lack of release history limits evidence that compatibility issues will receive fixes.

Repo commit activitycaution

The repository has had zero commits and zero active maintainers in the last three months, consistent with a project that has been inactive since January 2022. No newer activity compensates for that maintenance gap.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers or audit findings, but both referenced actions are unpinned. That leaves a limited build-integrity hygiene concern without evidence of an exploitable workflow path.