hotmeteor/receiver

Release historycaution

The package has existed for about 4 years with 22 releases, but only one release in the last 12 months despite a historical median interval of about 10 days. The recent release is positive, while the slower recent cadence warrants caution.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last 3 months. This suggests currently quiet maintenance, although the recent release and release notes provide some compensating evidence.

Security policycaution

The repository has no security policy, so users have no documented process for reporting vulnerabilities. This is a transparency gap for a webhook-handling library, though it does not by itself indicate unsafe code.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 7 action references are unpinned, leaving the build exposed to unexpected upstream action changes.