kduma/pkv

Release historycaution

This is the only release, published about 12 months ago, with no releases in the last 12 months. That leaves maintenance and release continuity unproven for a young package.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. For a package with only one release, that is a meaningful maintenance concern.

Security policycaution

The repository has no security policy. This is a transparency and incident-handling gap, though it is less significant than the maintenance and workflow findings.

Version stabilitycaution

Version v0.0.1 is not a stable major release, so compatibility expectations are limited. No recent prerelease churn partly reduces that concern.

Workflow auditcaution

The audit found a high-confidence bot-condition issue in the Dependabot auto-merge workflow, and all 9 action references are unpinned. The pull_request_target workflow has no untrusted checkout or script injection, so the workflow evidence is concerning hygiene rather than a severe standalone risk.