sanmai/pindx

Release historycaution

The latest registry release was published about five years ago, with no releases in the last 12 months. The 47-release history shows prior activity, but the published version is stale for a dependency.

Repo bus factorcaution

All two recent commits came from one contributor, leaving maintenance dependent on a single active person. The project is user-owned rather than organization-backed, so there is no shown handoff capacity to offset this concentration.

Security policycaution

No repository security policy was found. That reduces disclosure transparency, although the project does use Dependabot and this is not by itself evidence of unsafe code.

Version stabilitycaution

Version v0.3.0 is not a prerelease, but it remains below a stable major version. This is a modest maturity concern rather than a severe release-quality warning.

Workflow auditcaution

All 10 analyzed action references are unpinned, and a high-confidence audit found a workflow installing a package outside a lockfile. The workflows have no top-level write permissions and no untrusted checkout or script-injection paths, which limits the risk to hygiene and reproducibility concerns.