inmanturbo/path-router

Release historydanger

The package has had no registry release in about 2 years and 8 months, with zero releases in the last 12 months. Its four-release history shows limited ongoing maintenance.

Repo commit activitydanger

There were zero commits and zero active maintainers in the last 3 months, consistent with the broader multi-year release gap and indicating a strong abandonment concern.

Workflow auditdanger

The audit found a high-confidence bot-conditions issue in a Dependabot auto-merge workflow, with potentially spoofable actor checks. All 12 action references are also unpinned, and three workflows grant top-level write access, increasing publishing and automation risk.

Lifecycle scriptscaution

A post-autoload-dump lifecycle script runs during installation. This is an extra execution surface, but the signal does not show that the script is unsafe or unusually complex.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no shown organizational backing to compensate for the single publisher and inactive commit history.