paulo-hortelan/requests-graph-pulse

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, a material maintenance and abandonment risk.

Workflow auditdanger

All 12 action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so it is not independently severe.

Lifecycle scriptscaution

A post-autoload-dump install script adds execution during dependency installation, increasing supply-chain exposure compared with a package without lifecycle hooks.

Maintainerscaution

One registry maintainer creates a thin publishing base, although the linked repository is owned by the same individual, so the ownership is consistent rather than unexplained.

Project backingcaution

The registry namespace and repository owner match, but the project is backed by an individual rather than an organization, limiting visible maintenance capacity.