The package is licensed, has a clear README, minimal runtime dependencies, and recent repository activity. Four open pull requests, no registry release for nearly two years, and unpinned workflow actions warrant caution.
68%
Total Score
50
100
94
75
The latest registry release was in November 2024, with no releases in the last 12 months, which raises maintenance concerns; the repository was pushed recently, partly compensating for the stale release cadence.
There were no commits in the last three months and no active maintainers during that period, which weakens the recent maintenance picture despite the more recent repository push shown elsewhere.
Four pull requests remain open, while no issues or pull requests were merged in the last month; this suggests limited recent throughput but is not evidence of abandonment on its own.
The repository has no security policy, leaving disclosure and response expectations undocumented; the presence of Dependabot and Sonar provides some compensating security tooling.
The workflow has read-only permissions and no dangerous audit findings, but all 3 action references are unpinned, leaving avoidable build-integrity risk.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.