quantaforge/process

Release historydanger

This is the only release, published nearly three years ago, with no releases in the last 12 months. That provides little evidence of ongoing maintenance for a dependency.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and indicating a meaningful abandonment risk.

Licensecaution

The artifact includes an MIT license file, so the release is licensed, but the manifest declares it proprietary. That mismatch reduces metadata clarity despite the compensating license file.

Security policycaution

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap, though it is not evidence of a security defect by itself.

Workflow auditcaution

The pull_request_target workflow has no untrusted checkout or script-injection findings, but its sole action reference is unpinned. The trigger is ordinary on its own; the unpinned dependency is a modest supply-chain hygiene concern.