james.xue/lumen-generator

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer offers little evidence of broader maintenance capacity.

Release historycaution

Only two releases exist, with none in the last 12 months and the latest published in March 2022. This is a substantial maintenance concern for a framework integration package.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the long release gap, this raises abandonment risk.

Security policycaution

The repository has no security policy. This is a transparency gap, though the available tooling provides some partial compensation.

Workflow auditcaution

All seven analyzed action references are unpinned, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull-request trigger has no untrusted checkout or script-injection sink, so this is a caution rather than a severe workflow risk.