hexlet/points

Release historycaution

The package has only three releases across about five and a half years, with long gaps between them, but it released recently and the repository shows current activity.

Security policycaution

No repository security policy is published. This is a transparency gap, though the available Dependabot scanning partly offsets the concern.

Workflow auditcaution

All four analyzed action references are unpinned, and one workflow grants top-level write access, creating moderate workflow-hygiene risk. The pull_request_target workflow has no untrusted checkout or script-injection findings, and the audit completed successfully.