ilyabakhlinlebedev/framework

Release historydanger

The package reports 1,293 releases in its first day with a zero-day median interval, an unusually concentrated history that makes release provenance and maturity difficult to trust.

Repo commit activitydanger

The repository records zero commits and zero active maintainers over three months, a major maintenance and abandonment concern for a framework release.

Project backingcaution

The registry namespace and repository owner are the same user account, so the package has consistent ownership but no organization backing shown by this signal.

Repo popularitycaution

The repository has zero stars, forks, and watchers. Popularity is only supporting evidence, but this provides no corroboration for the package's unusually large release history.

Workflow auditcaution

All 13 workflows were analyzed and all 44 action references are pinned, but two high-confidence template-injection findings remain in the release workflow; the absence of an untrusted checkout or script-injection count keeps this as a hygiene concern rather than a standalone severe risk.