joshembling/image-optimizer

Lifecycle scriptscaution

A post-autoload-dump install script is present, adding some install-time execution surface, but the signal does not show a dangerous or unusual script.

Project backingcaution

The package and repository are owned by the same individual account, so the one-person ownership context does not provide organizational backing.

Release historycaution

The package has 21 releases over roughly three years, but only one release in the last 12 months, indicating a noticeably slower cadence.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, which is a meaningful recent-maintenance gap despite the repository remaining available.

Workflow auditcaution

All three workflows grant top-level write permissions and all seven action references are unpinned; the audit also found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. No untrusted checkout or script-injection sink was found, so this is a serious hygiene concern rather than a standalone critical verdict.