nowo-tech/beacon-bundle

Dangerous workflowscaution

Seven workflows were analyzed; one uses pull_request_target and one performs an untrusted checkout in a workflow_run context. No script-injection patterns were detected, but these workflow patterns warrant review because they can increase CI supply-chain exposure.

Release historycaution

The package is only 45 days old but has 40 releases, with a median interval of about 1 hour. This demonstrates active publishing, but the short history and unusually rapid cadence leave long-term stability less established.

Repo bus factorcaution

One contributor made 55 of 59 recent commits, or about 93%, which creates a meaningful concentration risk. The organization-owned repository and a second active contributor partially compensate, so this is caution rather than danger.

Repo popularitycaution

The repository has zero stars, forks, and watchers. Given the package is only 45 days old, this is limited supporting evidence rather than a decisive abandonment concern, but external adoption is not yet demonstrated.

Token permissionscaution

Five workflows lack top-level permissions and two declare top-level write access, with no workflows showing read-only permissions. This is weaker least-privilege hygiene and merits review, although it does not establish that the release is unsafe.