hexlet/trees
It has no published security policy, and all four workflow actions are unpinned. The repository still includes tests, a changelog, and release notes, with recent work from three contributors.
82%
Total Score
100
100
94
67
Health Score Breakdown
The package has only three releases since February 2021, with a median interval of about 2 years 9 months. One release in the last 12 months and the recent 2.0.0 publication provide some evidence of continued maintenance, so this is a moderate concern rather than abandonment.
The repository has no published security policy. This is a transparency gap for reporting vulnerabilities, although it is partly offset by the presence of Dependabot scanning.
All four analyzed action references are unpinned, so workflow behavior can change when upstream actions move; this is a workflow hygiene concern. The pull_request_target workflow has no untrusted checkout or script-injection sink, and the audit found no higher-severity issues.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Sergey Karpuk |
Direct Dependencies
No direct dependencies.
Weekly Downloads
Info
- Last Published
- 1 month ago
- Created
- 5 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.