farzai/viola

Maintainerscaution

Only one registry publishing account is listed, which limits publishing resilience. The organization-owned repository provides some compensating project backing.

Release historycaution

The package has had no registry releases in the last 12 months, and its latest release was over three years ago. This is a meaningful maintenance concern despite five total releases.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. That recent inactivity weakens confidence in continued maintenance.

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities. Dependabot provides some compensating security tooling.

Workflow auditcaution

All 10 analyzed action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-condition finding affects the Dependabot auto-merge workflow. There is no untrusted checkout or script injection, but the combined workflow hygiene is a real concern.