tyasa81/ezresponse

Maintainerscaution

One registry maintainer is responsible for publishing the package, creating a thin continuity base. The repository is also owned by that individual, so this is a genuine single-maintainer risk rather than an organization-publishing artifact.

Release historycaution

The package has had only two releases, both about 730 days ago, with none in the last 12 months. This suggests stalled release maintenance, although the linked repository was pushed more recently.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months. That weakens evidence of ongoing maintenance for a package whose latest registry release is already about 730 days old.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting expectations unclear. This is a transparency gap, but it does not by itself indicate that the package is unsafe.

Workflow auditcaution

All 3 analyzed action references are unpinned, and one workflow grants top-level write permissions. No untrusted checkout, script injection, or high-severity finding was reported, so this is a hygiene caution rather than a severe risk.