eventjet/asset-manager

Release historycaution

The package has 7 releases over about 6 years, with a median interval of about 12 months and 1 release in the last 12 months. The recent 1.1.0 release shows the project is not abandoned, but maintenance is infrequent.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. The recent release partly offsets this, but the current activity does not demonstrate an actively maintained project.

Repo package mentioncaution

The repository name does not exactly match the package name, and no README package mention was collected. Organization backing and the matching repository URL reduce concern, but package ownership is less transparent than ideal.

Workflow auditcaution

The single workflow was fully analyzed, but all 4 action references are unpinned and a high-confidence finding reports a container using the floating `latest` tag. This weakens build reproducibility, though no untrusted checkout, script injection, or broad write permission was found.