endroid/asset

Maintainerscaution

Only one account has registry publish access. This is a real concentration risk for publishing continuity, although the linked repository and release history show an identifiable project owner and ongoing releases.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent release history partly offsets this, but the lack of current development activity lowers confidence in ongoing support.

Security policycaution

The linked repository has no security policy. That weakens vulnerability-reporting transparency for a library with several runtime dependencies.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, injection findings, or write-wide permissions, but all five action references are unpinned. This is a supply-chain hygiene gap rather than a severe risk.