itk-dev/azure-ad-delta-sync

Lifecycle scriptscaution

The package runs a post-install command, which increases install-time behavior and deserves review, but the signal does not show that the script is unsafe or unusually broad.

Release historycaution

Only three releases have appeared since August 2021, with no release in the last 12 months and the latest release about 20 months ago. This indicates a slow, currently inactive release cadence despite the package's stable history.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Combined with the long gap since the latest release, this is meaningful evidence of currently quiet maintenance.

Security policycaution

The repository has no security policy, leaving the reporting and response process unclear. This is a transparency gap, but not severe enough to make the release unfit by itself.

Workflow auditcaution

The workflow audit completed successfully with no untrusted checkout, script-injection, or high-severity findings. However, all 10 analyzed action references are unpinned, weakening build reproducibility and supply-chain hygiene.