jkudish/plume
Clear documentation, licensing, and security reporting support adoption. The repository is still young and its workflows need tightening, especially action pinning and template handling.
76%
Total Score
80
100
94
88
Health Score Breakdown
One registry maintainer is consistent with a user-owned project, though it leaves publishing responsibility concentrated in one account.
The package and repository are owned by the same individual account, so there is no organization backing to offset the concentrated registry ownership.
The package is 211 days old with three releases, but all three were published in a short burst and the release cadence is not yet established.
Both workflows grant top-level write permissions, all six action references are unpinned, and the release workflow has high-confidence template-injection findings. No untrusted checkout or script-injection path was detected, so these are workflow hygiene concerns rather than a standalone severe risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Joey Kudish |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 illuminate/http Version ^11.0 || ^12.0 | — | — |
illuminate/support Version ^11.0 || ^12.0 | — | — |
Weekly Downloads
Info
- Last Published
- 7 months ago
- Created
- 7 months ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.