pulkitjalan/google-apiclient

Project backingcaution

The registry namespace and repository are owned by the same individual, so ownership is consistent, though the project does not have organization backing to broaden maintainer capacity.

Release historycaution

The package has 21 releases over roughly 12 years, but none in the last 12 months; the latest registry release was about 19 months before collection. This weakens confidence in ongoing maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last 3 months, a concrete sign of currently inactive development and increased abandonment risk.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance undocumented. This is a transparency gap, but not by itself evidence that the package is unsafe.

Workflow auditcaution

All four workflows were analyzed, but all 8 action references are unpinned. The audit also found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow and top-level write permissions there; the pull_request_target trigger has no untrusted checkout or script-injection sink, limiting the impact.