kevinpirnie/kpt-logger

Release historycaution

Only two releases exist, with the latest published about seven months ago. This is limited maturity evidence, though the release is stable rather than prerelease.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, with no newer push shown after the February release. That points to a thin or paused maintenance cadence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a small package this is a transparency and maintenance gap, not a severe risk by itself.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All five analyzed action references are unpinned, and the audit found high-confidence template-injection patterns in the release workflow. No untrusted checkout or script-injection trigger was found, so this remains a workflow-hygiene concern rather than a standalone severe risk.