rpungello/package-tracking

Maintainerscaution

One registry maintainer is consistent with a small user-owned project, but it leaves limited redundancy if that maintainer becomes unavailable.

Release historycaution

The package has four releases since November 2022, but no releases in the last 12 months and its latest registry release was April 2024, indicating a long release gap.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, weakening evidence of ongoing maintenance capacity.

Security policycaution

The README refers consumers to a security policy, but the linked repository contains no security policy file, leaving vulnerability-reporting guidance incomplete.

Workflow auditcaution

All four workflows were analyzed, but all nine action references are unpinned. A high-confidence bot-conditions finding affects the Dependabot auto-merge workflow, and that workflow has top-level write permissions; the pull_request_target trigger has no untrusted checkout or script-injection sink, limiting the severity.