dxw/2fa

Release historycaution

The package is 1,040 days old with 10 releases, but only 1 release in the last 12 months. That is ongoing maintenance, though the recent cadence is modest.

Repo commit activitycaution

The repository recorded 1 commit in the last 3 months from 1 active maintainer. A recent release and 7 merged pull requests in the last month provide some compensating activity, but direct commit activity remains thin.

Security policycaution

The linked repository has no security policy. That leaves vulnerability reporting and response expectations undocumented for a security-sensitive authentication plugin.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, script injection, or audit findings, but all 7 action references are unpinned. This leaves build inputs less reproducible and warrants a hygiene caution.