dsuurlant/takeout-redate

Workflow auditdanger

The release workflow has a workflow_run trigger, an untrusted checkout, and two high-confidence template-injection findings in the same workflow; all 19 action references are unpinned and one workflow grants top-level write access. This is a material supply-chain hygiene risk, although no script injection was reported.

Release historycaution

Only 2 releases exist, both within roughly 2 days, with no further release activity over the following months. The limited history provides little evidence of sustained maintenance.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. For a package that is only about 10 months old, this suggests maintenance may have stopped after the two-release launch.

Repo popularitycaution

The repository has 0 stars, forks, and watchers. This is weak supporting evidence and indicates a very small user base, but popularity alone is not a health verdict.

Repo toolingcaution

Composer and Box provide an explicit build process, which supports reproducible packaging, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene gap.