viest/xlswriter

Project backingcaution

The registry namespace and repository are owned by the same individual, providing direct ownership continuity but no organizational backing to offset contributor concentration.

Repo bus factorcaution

One contributor made 52 of 56 recent commits, or about 93%, so maintenance depends heavily on a single person despite two additional contributors being active.

Repo toolingcaution

Composer is used for builds, but no security scanning tool was detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, so there is no documented process for reporting or handling vulnerabilities.

Workflow auditcaution

All 10 analyzed action references are unpinned, and the audit found high-confidence template-injection patterns plus an unpinned latest container image. No untrusted checkout or dangerous trigger was found, limiting the impact to workflow hygiene rather than a severe release risk.