smart-dato/arco-spedizioni-sdk

Repo bus factorcaution

One contributor made all 7 commits in the last 3 months, creating a thin operational base; organization ownership provides some capacity to hand maintenance off but no second active contributor is shown.

Repo commit activitycaution

Seven commits were made in the last 3 months, so activity has not stopped, although all activity came from one maintainer.

Repo package mentioncaution

The repository name does not match the full package name and its README does not mention that package name, creating some uncertainty about the exact package-to-repository relationship despite the related naming.

Version stabilitycaution

Version 0.0.19 is not a stable major release, so its public API may still change despite the absence of prerelease versions.

Workflow auditcaution

All five workflows were analyzed and all 11 action references are pinned, but a high-confidence bot-conditions finding reports spoofable actor context in the Dependabot auto-merge workflow; two workflows also grant top-level write access.