Documentation and packaging are strong, with repository tests, a changelog, and a clear license. Maintenance has been quiet recently and the workflow uses six unpinned actions, so pinning this version and checking future updates is sensible.
68%
Total Score
75
100
94
88
One registry maintainer is consistent with a user-owned project, but it leaves a limited visible publishing base if that maintainer becomes unavailable.
The project is longstanding and released twice in the last 12 months, but only five releases over roughly 11 years and a median interval of about two years indicate a slow release cadence.
The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance gap despite the recent release push.
All six action references are unpinned, so workflow inputs can drift and are less reproducible. The two cache-poisoning findings are low-confidence and therefore remain a hygiene concern rather than a severe risk; permissions are read-only and the audit was complete.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.