roukmoute/polyfill-calendar

Project backingcaution

The package and repository are owned by the same individual account, so the source ownership is consistent. The single-owner structure still leaves a relatively narrow maintenance base.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. This is a meaningful maintenance warning, although the recent February 2026 release provides some compensating evidence.

Security policycaution

The repository has no security policy. For a small library this is a transparency and vulnerability-reporting gap, though it is not severe on its own.

Workflow auditcaution

Both workflows were fully analyzed with no detected sinks or high-confidence audit findings, and neither grants top-level write access. However, all 8 action references are unpinned, leaving the build exposed to moving action versions.