hasnayeen/blade-ssg

Release historydanger

The latest release was nearly three years ago, with no releases in the last 12 months. Four releases were concentrated at the package's start, providing weak evidence of ongoing maintenance.

Repo commit activitydanger

There were zero commits and zero active maintainers in the last three months, reinforcing the release-history evidence of a project with little current maintenance.

Workflow auditdanger

All 12 action references are unpinned, three workflows grant top-level write permissions, and the audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a serious hygiene concern rather than a standalone critical finding.

Maintainerscaution

Only one registry account has publish access. This is not proof of abandonment, but it leaves little publishing redundancy for a user-owned project.

Project backingcaution

The package is backed by a user-owned repository rather than an organization, so the single registry maintainer does not have organizational backing to offset the thin maintainer base.