mr-vaco/nova-trumbowyg-field

Release historycaution

The package has only two releases, with none in the last 12 months and roughly 19 months since the latest release at collection time. This indicates a thin and currently inactive release cadence.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, which weakens evidence of ongoing maintenance even though the repository is not archived.

Security policycaution

No security policy was found in the linked repository, leaving vulnerability-reporting expectations unclear. This is a transparency gap, not evidence that the package is unsafe.

Workflow auditcaution

The single analyzed workflow has top-level write permissions and all 4 action references are unpinned. No dangerous trigger, untrusted checkout, script injection, or high-confidence audit finding was reported, so this is a hygiene concern rather than a severe risk.