dannecron/coverage-merger

Release historydanger

Only two releases exist, and none were published in the last 12 months; the latest release is about three years old. This is strong evidence of possible abandonment.

Repo commit activitydanger

The repository had zero commits and zero active maintainers in the last three months, with the last push occurring about three years ago. No provided signal compensates for the lack of recent maintenance.

Maintainerscaution

The package has one registry maintainer, and the repository is owned by a user rather than an organization. This is a thin maintenance base, especially alongside the absence of recent activity.

Security policycaution

The repository has no security policy. This is a transparency gap for a maintained package, though it is less significant than the lack of recent releases and commits.

Workflow auditcaution

Both workflows were analyzed successfully and have no untrusted checkout or script-injection findings, but all 9 action references are unpinned. The high-confidence template-injection findings are hygiene concerns here because no pull_request_target or workflow_run trigger was reported.