The repository has tests, release notes, a clear consumer README, and an explicit license. Maintenance is recent but sparse, and all 13 workflow actions are unpinned; monitor follow-up activity and workflow changes.
70%
Total Score
50
93
50
The package has existed for over 12 years and released 1 version in the last 12 months, with a median interval of about 228 days. The recent 3.0.0 release is positive, but the overall cadence is modest.
The repository recorded 0 commits and 0 active maintainers in the last 3 months, although it was pushed shortly after the assessed release. This suggests limited ongoing activity rather than clear abandonment.
No security policy was found in the linked repository, leaving vulnerability-reporting expectations undocumented. The repository does use Dependabot, which provides some compensating security maintenance.
All 13 analyzed action references are unpinned, and one workflow grants top-level write permissions. No untrusted checkout, script injection, dangerous trigger, or auditor finding was detected, so this is workflow hygiene caution rather than a severe risk.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.