The package has a clear MIT license, documentation, repository tests, and only one runtime dependency. Its 15 unpinned workflow actions are a supply-chain hygiene concern, while zero commits in three months merits monitoring.
78%
Total Score
50
100
100
100
The repository is owned by an individual user rather than an organization, so the project does not show organizational backing; other maintenance evidence partly offsets the thinner continuity guarantee.
There were zero commits and zero active maintainers in the last three months, which weakens evidence of ongoing development, although recent merged pull requests and the latest release provide some compensation.
Both workflows were fully analyzed with no audit findings, no untrusted checkouts, and no script injection; however, all 15 action references are unpinned, leaving avoidable workflow supply-chain exposure.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.