james.xue/ali-safe-api

Project backingcaution

The repository is owned by an individual account rather than an organization, and the registry and repository owners differ. This leaves limited visible backing for long-term maintenance.

Release historycaution

The package has 12 releases since January 2019, but none in the last 12 months; the latest registry release was in April 2025. This indicates a meaningful maintenance slowdown.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a direct maintenance concern, although the repository's recent push date provides some partial context.

Security policycaution

No security policy is present in the repository. This weakens vulnerability-reporting transparency, but it is a moderate hygiene gap rather than evidence of abandonment by itself.

Workflow auditcaution

All four analyzed action references are unpinned, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so it is not independently dangerous.