matriphe/iso-639

Workflow auditdanger

All three workflows were analyzed, but all eight action references are unpinned. The release workflow combines a workflow_run trigger, an untrusted checkout, and top-level write permissions, creating a meaningful release-pipeline exposure despite no auditor findings.

Maintainerscaution

Only one registry account can publish the package. The linked repository is user-owned rather than organization-backed, so this leaves a thin publishing and continuity base.

Project backingcaution

The registry namespace and repository owner match, which supports ownership continuity, but the owner is an individual rather than an organization.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This weakens evidence of ongoing maintenance, although the recent release and push provide some compensation.

Repo issue activitycaution

There is only one open issue and one open pull request, but no issues or pull requests were opened or merged in the last month. This is a minor sign of limited current interaction, not abandonment by itself.