ottosmops/pdftothumb

Repo bus factorcaution

All recent commits came from one contributor, so maintenance depends entirely on that person. The linked repository is clearly the package project, but no contributor redundancy is shown.

Repo commit activitycaution

The repository had one commit in the last three months from one active maintainer. Recent activity is present, but the very low volume provides limited evidence of sustained maintenance capacity.

Security policycaution

The repository has no published security policy. This is a transparency gap for reporting vulnerabilities, though it is partly offset by the package's small, tested scope.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkout or script-injection findings. However, all 3 referenced actions are unpinned, leaving avoidable supply-chain drift risk.