iranimij/openimport

Workflow auditdanger

All three workflows were analyzed, but two high-confidence template-injection findings occur in the release workflow. Two workflows also grant top-level write permissions, and 10 of 12 action references are unpinned; together these make release automation a meaningful supply-chain hygiene concern.

Project backingcaution

The registry namespace and repository owner match, but ownership is by an individual account rather than an organization. That is consistent and transparent, though it provides limited visible backing capacity.

Release historycaution

This is a very new package, with three releases published within less than a day. That shows active initial iteration but provides little long-term maintenance history.

Repo commit activitycaution

The repository records zero commits and zero active maintainers over the last three months. Although recent releases and merges show initial activity, the missing sustained commit activity raises maintenance risk.