inmanturbo/futomaki

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, which carries elevated workflow risk, but no untrusted checkouts or script-injection patterns were detected.

Maintainerscaution

Only one registry account has publish access. That is a thin publishing base for a user-owned project and increases continuity risk if that maintainer becomes inactive.

Project backingcaution

The registry namespace and repository owner match, but the project is backed by a single user rather than an organization, providing limited visible continuity beyond that maintainer.

Release historycaution

The package has had no releases in the last 12 months, and its latest release was over two years ago. This is a meaningful maintenance concern for a framework-integrated library, despite its history of 16 releases.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, consistent with the long release gap and indicating stalled ongoing development.