josantonius/mercadona-importer

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers during the last three months, consistent with maintenance having stopped for more than two years. This materially raises abandonment risk.

Release historycaution

The package has four releases since January 2023, but none in the last 12 months and the latest was published in May 2024. This indicates a maintained history followed by a prolonged release gap.

Repo toolingcaution

The project uses Composer and Make, showing basic build tooling, but no security-scanning tool was detected. For this small CLI the missing scanner is a modest hygiene gap rather than a severe dependency risk.

Security policycaution

No repository security policy was found. This reduces transparency for reporting and handling vulnerabilities, though it is not evidence that the package is unsafe.

Workflow auditcaution

The single workflow was fully analyzed, has read-only permissions, and has no untrusted checkout or injection findings. However, both of its two action references are unpinned, leaving avoidable build-reproducibility and action-substitution risk.