railken/amethyst-product

Release historydanger

The package has made no release in about 6 years and 6 months; its latest release was March 31, 2020, despite 26 releases overall. This is strong evidence of abandonment for a dependency.

Repo commit activitydanger

The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with the release history showing no releases in the last 12 months. The repository is not archived, but that does not offset the lack of observed activity.

Repo toolingcaution

Composer is used for the build, but no security-scanning tool was detected. This is a modest transparency and maintenance gap alongside the stale project activity.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, although it is secondary to the much stronger abandonment evidence.

Workflow auditcaution

All 6 of 6 action references are unpinned, and the audit found a high-confidence, high-severity unpinned container image in test.yml. The workflows were fully analyzed and showed no untrusted checkout or script-injection path, which limits the concern but does not remove the reproducibility risk.