legatus/event-dispatcher

Release historycaution

The package has only two releases, with none in nearly six years; this is strong evidence of inactivity and raises abandonment risk.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, consistent with the long release gap and limited evidence of ongoing maintenance.

Security policycaution

The repository has no security policy, leaving the process for reporting vulnerabilities unclear; the package's tests and security scanning provide some compensating engineering evidence.

Workflow auditcaution

All 12 analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene. The audit found no untrusted checkouts, script injection, or higher-severity findings, so this remains a caution rather than a severe risk.