darvis/api-x

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer reflects a genuinely thin ownership base. The linked repository and package identity are consistent, partially reducing that concern.

Release historycaution

This release is part of a package published less than a day ago, with four releases in that period. The rapid initial releases show activity but provide no meaningful long-term maintenance history.

Repo commit activitycaution

There were no commits or active maintainers in the preceding three months, but the repository was pushed less than an hour ago and the package itself is less than a day old. The short history limits confidence rather than proving abandonment.

Workflow auditcaution

The only workflow was fully analyzed and has no untrusted checkout or script-injection findings, but it inherits secrets with high-confidence medium severity and uses its only action without pinning. It lacks a top-level permissions block, which is acceptable on its own but provides less explicit permission control.