farzai/bitkub

Release historycaution

The latest registry release was 1.1.0 on December 24, 2023, with no releases in the last 12 months. This is partly balanced by the linked repository remaining active enough to have a recent push, but the published release cadence is a real maintenance concern.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This weakens evidence of ongoing maintenance, even though the repository is not archived.

Security policycaution

No repository security policy was found. For a package handling exchange API credentials, this is a transparency gap, although it does not by itself show that the package is unsafe.

Workflow auditcaution

All 10 analyzed action references are unpinned, and three workflows grant top-level write permissions; the audit also reports a high-confidence bot-conditions finding in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so these are workflow hygiene and maintenance concerns rather than a severe standalone risk.