pulkitjalan/ip-geolocation

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign that maintenance has stalled around this release.

Workflow auditdanger

All seven action references are unpinned, and a high-confidence bot-conditions finding reports spoofable actor context in the auto-merge workflow; one workflow also grants top-level write access. The pull_request_target trigger has no untrusted checkout or script-injection sink, so it is not independently severe.

Maintainerscaution

A single registry maintainer is consistent with the repository being user-owned, but it leaves limited publishing redundancy if that maintainer becomes unavailable.

Project backingcaution

The registry namespace and repository are owned by the same individual account, showing direct ownership but no organizational backing or maintainer redundancy.

Release historycaution

The package has 36 releases over about two years, but only one release in the last 12 months indicates a notably slower release cadence.