lara-zeus/echoo

Release historycaution

Five releases in the last 12 months, all within the package's 77-day history, show active early development. The short history leaves maturity and long-term maintenance unproven.

Repo bus factorcaution

All 17 commits in the last three months came from one contributor, creating a real continuity risk. Organization ownership provides some ability to hand off maintenance, which keeps this from being a severe risk.

Workflow auditcaution

The audit found a high-confidence, high-severity bot-condition issue in the Dependabot auto-merge workflow. Its pull_request_target trigger has no untrusted checkout or script-injection sink, but the condition still weakens workflow safety.