netlogix/dependency-resolver

Release historycaution

The package is over two years old but has only three releases, with one release in the last 12 months and a median interval of about 473 days. The recent 1.2.0 release shows it is not abandoned, but maintenance is infrequent.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent release and August push provide some compensating evidence, but current development activity remains thin.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the link is not clearly established. A mismatch can be normal for a sub-package, but no provided evidence confirms that here.

Workflow auditcaution

All 11 analyzed action references are unpinned, and the release workflow has top-level write permissions plus two high-confidence findings that its app token inherits blanket installation permissions. The audit completed fully and found no untrusted checkout or script injection, but the release automation still warrants caution.