eximoo/signature-pad

Release historycaution

Only three releases exist, with none in the last 12 months; the latest release was about 18 months ago. This points to reduced maintenance activity, although the package is still marked stable and is not deprecated.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. That is a meaningful abandonment concern for a package whose latest registry release was already about 18 months ago.

Workflow auditcaution

All 12 analyzed action references are unpinned, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a workflow hygiene and automation-integrity concern rather than a severe standalone risk.