undpaul/schema-validator

Lifecycle scriptscaution

The package runs post-install and post-update scripts, which increases installation complexity and the code executed during dependency operations. No other provided signal shows these hooks are unsafe, so this is a limited concern rather than a severe risk.

Release historycaution

This is the only release, published about two years ago, with no releases in the last 12 months. That leaves maintenance and compatibility uncertain for a package intended as a reusable tool.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, consistent with the package having remained unchanged since its first release. This is meaningful abandonment risk despite the repository not being archived.

Security policycaution

The repository has no security policy. For a validation tool this is a transparency and vulnerability-reporting gap, although tests, a public repository, and release notes provide some compensating evidence.

Workflow auditcaution

Both workflows were fully analyzed with no untrusted checkouts, script injection, or audit findings, but all 8 action references are unpinned. The clean audit offsets some concern, while unpinned references remain a workflow reproducibility and maintenance gap.