It is licensed, documented, tested, and backed by a matching organization repository with static analysis. The prerelease label, unpinned workflow actions, and absent security policy leave maintenance and workflow hygiene weaker than ideal.
56%
Total Score
50
100
79
50
The latest release was over five years ago, with no releases in the last 12 months and only seven releases overall. This is strong evidence of inactivity, although the package is not archived or deprecated.
The repository recorded zero commits and zero active maintainers over the last three months, consistent with the long release gap. The repository remains available, but there is no observed recent maintenance capacity.
No security policy was found in the linked repository. For a small interface package this is a transparency gap, though it is less severe than the observed maintenance hiatus.
The assessed version is a prerelease and the recent release history is mostly prereleases, so the API may not be mature or stable. The package's documentation and release notes provide some transparency but do not offset the stability concern.
The single workflow was fully audited with no high-confidence findings, dangerous triggers, or injection sinks. However, both action references are unpinned, leaving the build exposed to changes in those referenced actions.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.