gulaandrij/google-sheets-bundle

Project backingcaution

The registry namespace and repository are owned by the same individual account, so the package has clear ownership but no demonstrated organizational backing. The two recent contributors provide some practical support.

Release historycaution

The package is only 104 days old and has seven releases, with releases concentrated early in its life. This shows initial activity but provides limited evidence of long-term maintenance.

Repo commit activitycaution

Only two commits were recorded in the last three months, from two active contributors. The presence of two contributors helps, but the small volume gives limited evidence of ongoing maintenance.

Security policycaution

The repository has no security policy. That is a transparency gap for a bundle handling Google credentials, even though security scanning is present.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-severity findings, but all six action references are unpinned and the workflow has no top-level permissions block. The unpinned references create a modest supply-chain hygiene concern.