karanshukla/php-atproto-identity

Maintainerscaution

A single registry maintainer is consistent with an individual-owned project, but it gives the release a narrow publishing base if that maintainer becomes unavailable.

Project backingcaution

The package and repository are owned by the same individual account, so the source relationship is clear, but there is no organizational backing shown to broaden maintenance capacity.

Release historycaution

Four releases were published within hours on the package's first day, showing active initial delivery but providing no evidence yet of sustained maintenance.

Repo commit activitycaution

No commits or active maintainers were observed in the last three months. Because the repository is brand new, this mainly means there is not yet enough history to demonstrate durable maintenance.

Workflow auditcaution

Both workflows were analyzed successfully and use read-only permissions with no dangerous triggers or audit findings. However, all 10 action references are unpinned, leaving avoidable supply-chain drift risk.