sghimire/nepali-date-library

Release historycaution

The package is only 64 days old with two releases about 16 days apart, so its release pattern is encouraging but its long-term maintenance record remains limited.

Repo bus factorcaution

All six recent commits came from one contributor, leaving maintenance dependent on a single person despite the recent activity.

Repo toolingcaution

Composer is used for builds, providing standard package tooling, but no security-scanning tool was detected, leaving security checks less explicit.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, though it does not by itself indicate unsafe code.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings, and it scopes permissions at job level. However, all four action references are unpinned, leaving avoidable build reproducibility and action-update risk.