felixnagel/fe-performance

Workflow auditdanger

The complete audit found two high-confidence template-injection findings in the release workflow and one script-injection count; both actions are also unpinned. The workflow has no top-level permissions block, which is acceptable alone, but the injection findings make release automation a material supply-chain hygiene concern.

Maintainerscaution

Only one account has registry publish access. The project is user-owned rather than organization-backed, so this represents a real single-maintainer continuity risk.

Project backingcaution

The registry namespace and repository are owned by the same individual account, confirming a consistent project owner but no organizational backing to compensate for the thin maintainer base.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although the recent push and release history provide some compensation, this still indicates weak current maintenance activity.

Repo popularitycaution

The repository has 4 stars, 0 forks, and 1 watcher. Low adoption is supporting evidence of a small project, but it is not by itself a dependency-health failure.