Documentation, tests, licensing, and a small dependency surface make the package easy to evaluate. Maintenance has been quiet since June, while the release workflow has unpinned actions and a high-confidence template-injection finding.
58%
Total Score
50
100
92
75
The package is young at 226 days with four releases, but all releases were concentrated by February and no newer registry release is shown, limiting evidence of ongoing maintenance.
The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful sign that maintenance may have slowed or stopped.
Both analyzed workflows use unpinned actions, and the release workflow has a high-confidence template-injection finding; its top-level write permission adds mild exposure, though no untrusted checkout or script-injection path was found.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.