vivutio/devkit-module

Release historycaution

The package is only 1 day old with 2 releases, so there is not enough history to establish mature maintenance or release stability.

Repo bus factorcaution

All 4 recent commits came from one contributor, creating a concentrated maintenance risk; organization backing provides some capacity for handoff but does not show a second active contributor.

Security policycaution

The linked repository has no security policy, leaving no documented channel or process for reporting security issues.

Version stabilitycaution

This is a non-stable 0.x release, which signals an API that may still change even though it is not marked as a prerelease.

Workflow auditcaution

All 11 analyzed action references are unpinned, two workflows grant top-level write access, and high-confidence template-injection findings appear in two workflows. There are no untrusted checkouts or script-injection findings, so this is workflow hygiene and supply-chain caution rather than a standalone severe risk.