jobadssit/weight-converter

Release historydanger

The package has had no release in about three years and eight months, with zero releases in the last 12 months. Its six releases arrived within roughly two hours, so the long subsequent gap is a meaningful abandonment concern.

Repo commit activitydanger

There were zero commits and zero active maintainers in the last three months. Combined with the multi-year release gap, this is strong evidence of inactive maintenance.

Workflow auditdanger

All eight analyzed action references are unpinned, and the audit found high-confidence bot-condition and unpinned-container-image issues. The pull_request_target workflow has no untrusted checkout or script-injection sink, so these are serious hygiene concerns rather than standalone proof of compromise.

Project backingcaution

The repository is owned by an individual rather than an organization, and the package registry namespace differs from that owner. This leaves limited visible organizational backing for a project already showing inactivity.

Repository archivedcaution

The linked repository is not archived, but its last push was about two years and eleven months before collection, which is consistent with the observed maintenance slowdown.