deepcube/handoff-image-upload

Release historycaution

Only one release has been published, with no additional release in about 360 days; this provides little evidence of an established release cadence.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, which is a meaningful sign of slowed maintenance for a package with only one release.

Repo issue activitycaution

There are no open issues and four open pull requests, but no pull requests were merged in the last month; this offers limited evidence of active community or maintainer response.

Workflow auditcaution

All 12 action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding reports spoofable actor checks in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so these are workflow hygiene and supply-chain safeguards concerns rather than an automatic severe failure.