neubau-kompass/storybook-bundle

Release historycaution

The package is only 144 days old and has two releases, both published within about 48 minutes on the first release day. That leaves too little release history to demonstrate sustained maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. For a package this young, that is a meaningful maintenance warning rather than evidence of established stability.

Repo toolingcaution

The repository uses Composer for builds but reports no security scanning tools. The build tooling is appropriate, while the missing scanning is a modest transparency and maintenance gap.

Version stabilitycaution

Version v0.1.1 is not a stable major release, and the README says the bundle is under active development with APIs and workflows subject to change. Consumers should expect compatibility risk while the project matures.

Workflow auditcaution

The audit covered both workflows and found no untrusted triggers or script-injection sinks, but all 29 action references are unpinned and CI installs a package outside the lockfile. The cache-poisoning finding has low confidence and is hygiene only.