jardissupport/validation

Maintainerscaution

Only one registry maintainer account is listed, which is a limited publishing base; the organization-owned repository provides some compensating backing.

Repo bus factorcaution

All eight recent commits came from one contributor, creating a real continuity risk; organization ownership partly mitigates handoff risk but no second active contributor is shown.

Repo popularitycaution

The repository has zero stars, forks, and watchers. This is weak supporting evidence, but the package is only 78 days old and popularity is not decisive.

Security policycaution

The repository has no SECURITY.md or other security policy, leaving vulnerability-reporting expectations unclear for a package intended for application integration.

Workflow auditcaution

All three workflows were analyzed, but auto-release.yml has one high-confidence template-injection finding alongside a script-injection count, one workflow with top-level write permissions, and all seven action references unpinned. The absence of an untrusted checkout or dangerous trigger limits the severity, but release-workflow hygiene remains a concern.