laruence/taint

Release historycaution

This package has only one registry release, published 47 days ago, so its release track record is still limited. Recent repository activity provides some compensating evidence, but registry maturity remains unproven.

Repo bus factorcaution

One contributor made 38 of 39 recent commits, leaving maintenance highly concentrated despite a second contributor being active.

Security policycaution

The repository has no security policy, which weakens vulnerability-reporting transparency for an extension intended to detect security issues.

Workflow auditcaution

All three workflows were analyzed with no high-confidence audit findings or untrusted checkouts, but all 10 action references are unpinned and one workflow grants top-level write permissions. These are workflow hygiene and supply-chain exposure concerns, not severe risks on their own.