Documentation and test coverage are solid, with clear organizational ownership and security tooling. The package has had no release or commit activity for roughly five years, and its workflows use unpinned images and actions.
40%
Total Score
50
80
75
The package has had only three releases, all ending in February 2021, with no releases in the last five years. This is strong evidence of abandonment for a dependency whose compatibility may need maintenance.
The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. The repository is not archived, but observed maintenance activity has effectively stopped.
All 13 analyzed action references are unpinned, and the audit found a high-confidence, high-severity unpinned container image. The workflows have no top-level permissions block, but they do not use top-level write permissions and expose no untrusted checkout or injection sink.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.