kevinpirnie/kpt-cache

Release historycaution

The package is newly published: it is 0 days old with one release and no established release interval, so long-term maintenance is unproven.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, but the package was only published 0 days ago, making this chiefly an unproven-maintenance concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected, leaving repository security checks less transparent.

Security policycaution

No repository security policy was detected, which is a transparency gap for a package intended to support production caching.

Workflow auditcaution

All 6 analyzed action references are unpinned, and the audit found three high-confidence template-injection findings in the release workflow. The workflows have no top-level permissions block, but one scopes permissions at job level and no untrusted checkout or script-injection trigger was found.