fabyo0/weight-conversion

Release historycaution

The package is 287 days old but has only two releases, both within about two days of each other. This provides limited evidence of sustained release maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. Although the repository is not archived and was pushed more recently, this still indicates a quiet maintenance period.

Security policycaution

The repository has no security policy. For a small utility package this is a transparency gap, though the package does use Dependabot security scanning.

Workflow auditcaution

All 12 analyzed action references are unpinned, and the audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. No untrusted checkout or script-injection sink was detected, so this is a hygiene and workflow-integrity concern rather than a severe standalone risk.