softspring/time-ago-bundle

Repo bus factorcaution

All recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is shown in this period.

Repo commit activitycaution

Only one commit from one active maintainer was recorded in the last three months, a limited recent activity signal; the frequent registry releases partly compensate for this gap.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations less transparent.

Workflow auditcaution

Both workflows use read-only permissions and contain no detected injection or high-severity findings, but all 7 action references are unpinned, leaving them exposed to upstream reference changes.