swiatprzesylek/gl

Licensecaution

The manifest declares the package proprietary, while the repository license file is recognized as MIT. The repository provides a license, but the mismatch creates avoidable legal and transparency uncertainty.

Release historycaution

The package has 26 releases but none in the last 12 months; its latest release was about 19 months ago. This weakens confidence in ongoing maintenance despite the substantial release history.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The repository is not archived, but this recent inactivity raises maintenance risk.

Security policycaution

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap, though it is not evidence that the package is unsafe.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no reported security findings, but both analyzed actions are unpinned. That leaves a modest reproducibility and supply-chain hygiene gap.