rokde/number-generator

Project backingcaution

The package and repository are owned by the same individual account, so there is no organization backing shown to compensate for the thin maintainer base.

Release historycaution

This is the only release, published nearly three years ago, with no releases in the last 12 months. That leaves the package's compatibility and ongoing maintenance uncertain despite the repository being updated more recently.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. This conflicts with the recent push timestamp and the single old release, so current development capacity is uncertain.

Security policycaution

The repository has no security policy. For a library intended to be integrated into applications, that weakens the project's vulnerability-reporting transparency.

Workflow auditcaution

All 12 action references are unpinned, and three workflows grant top-level write permissions. A high-confidence bot-conditions finding affects the pull_request_target automation; although no untrusted checkout or script injection was found, these are meaningful workflow-hygiene concerns.