uhifadhi/devkit-module

Release historycaution

The package is less than a day old, despite six releases in roughly 14 hours. That shows active initial work but provides no long-term maintenance history.

Repo bus factorcaution

One contributor made all 17 recent commits, creating a genuine concentration risk. Organization ownership provides some handoff capacity but no second active contributor is shown.

Security policycaution

The repository has no security policy, leaving reporting and response expectations undocumented. This is a transparency gap rather than evidence of unsafe code.

Version stabilitycaution

Version v0.1.5 is not a stable major release, so its API and behavior may still change substantially.

Workflow auditcaution

The audit completed both workflows and found no untrusted checkout or script-injection trigger, but all 12 action references are unpinned and the release workflow has seven high-confidence template-injection findings plus top-level write permissions. These are meaningful CI hygiene concerns, though not independently a severe health verdict.