tapp/filament-confetti

Release historycaution

The package is young at 147 days old with three releases and a median interval of about 33 days; this shows activity but limited long-term history.

Repo bus factorcaution

One contributor made all two recent commits, creating a thin operational base. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Only two commits were made in the last three months, indicating limited recent maintenance activity even though the repository was pushed recently.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected; the repository's separate security policy partly offsets this transparency gap.

Workflow auditcaution

All five workflows were analyzed, but all 12 action references are unpinned, two workflows grant top-level write access, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. No untrusted checkout or script-injection sink was found, so this is a hygiene and workflow-safety concern rather than a severe standalone risk.