fragotesac/zf1-navigation

Release historycaution

This is the package's only release, published about two years ago, with no releases in the last 12 months; that indicates limited maintenance evidence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing the concern that maintenance has stopped since the initial release.

Security policycaution

No security policy is present in the linked repository, leaving vulnerability-reporting expectations unclear; this is a transparency gap, not evidence of unsafe code.

Workflow auditcaution

All five action references are unpinned, and a high-confidence audit finding reports a spoofable actor condition in the Dependabot auto-merge workflow. The audit was complete and found no untrusted checkout or script-injection sink, so these are cautions rather than a standalone severe risk.