jansuchanek/nattachments

Project backingcaution

The package is backed by a personal repository owner rather than an organization, so the small maintainer footprint offers no organizational redundancy.

Release historycaution

Only two releases arrived on the same day, with no newer release for about six months. That leaves maintenance continuity unproven for a relatively new package.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. Combined with only two same-day releases, this is a meaningful maintenance concern.

Repo toolingcaution

Composer is used for the build, but no security-scanning tools are configured. That is a hygiene weakness for a package handling file uploads, though it is not evidence of abandonment by itself.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, sinks, or audit findings, but both of its two action references are unpinned. The lack of a top-level permissions block is acceptable on its own, while unpinned actions leave avoidable supply-chain exposure.