matesofmate/common

Dangerous workflowscaution

One workflow uses pull_request_target, a workflow form that requires careful handling of untrusted pull-request content. No untrusted checkout or script injection was detected, which materially limits the concern.

Maintainerscaution

Only one account has registry publish access. Because the source repository is organization-owned, this is ordinary publishing hygiene rather than decisive evidence of weak project backing, but it still leaves release operations concentrated.

Repo bus factorcaution

All seven recent commits came from one contributor, giving the repository a high bus-factor risk. Organization backing partially compensates for this, but no second active contributor is shown.

Repo issue activitycaution

There are no open issues or pull requests and no recent issue or pull-request activity. This is not inherently negative for a small package, but it provides little evidence of community review or usage.

Repo popularitycaution

The repository has zero stars, forks, and watchers. Popularity is only supporting evidence, so this lowers external validation but does not by itself make a small, active package unhealthy.