imagewize/marin

Release historycaution

The package is newly published, with 10 releases concentrated within one day. This shows active initial delivery but provides little evidence of long-term maintenance.

Repo commit activitycaution

There were no commits and no active maintainers recorded in the last three months. The recent release and merged pull requests provide some activity evidence, but the missing commit activity still raises abandonment concerns.

Repo toolingcaution

Composer is used as a build tool, but no security scanning tools are detected. This is a modest transparency and maintenance gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures undocumented.

Workflow auditcaution

All 9 of 9 action references are unpinned, and the audit found a high-confidence template-injection issue in create-release.yml. No untrusted checkout or script-injection trigger was found, so this is workflow hygiene risk rather than a severe standalone dependency risk.