The focused package is easy to inspect and has current tests and release notes. Its maintenance depth and workflow reproducibility remain limited, so pin this version and monitor future releases.
68%
Total Score
83
100
93
67
The package has only two releases over about 5 years, with an interval of roughly 4 years 11 months, although one release arrived in the last 12 months. This indicates a mature but sparsely released project rather than strong ongoing release momentum.
All three recent commits came from one contributor, creating a concentrated maintenance risk. Organization backing provides some continuity, but no second active contributor is shown.
The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap, though the focused package and clean workflow audit provide some compensation.
The single workflow was fully analyzed with no untrusted checkouts, script injection, or audit findings, but both referenced actions are unpinned. The workflow also lacks a top-level permissions block, which is acceptable on its own.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.