vjik/specification
Clear licensing, focused dependencies, tests, and security scanning make the project straightforward to evaluate. Maintenance has not continued since the initial release, and its workflows use an untrusted checkout with all 20 actions unpinned.
60%
Total Score
50
100
94
75
Health Score Breakdown
This is the sole release, published about 1 year and 10 months ago, with no releases in the last 12 months. That limited history and long silence reduce confidence in ongoing maintenance.
The repository recorded zero commits and zero active maintainers in the last 3 months, consistent with the absence of newer releases. The repository is not archived, but current maintenance capacity is unproven.
All 20 referenced actions are unpinned, and the cs workflow combines pull_request_target with one untrusted checkout, creating workflow supply-chain and untrusted-code exposure. The audit completed successfully and found no script injection or high-severity findings, which limits the impact.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
No maintainer information available.
Direct Dependencies
No direct dependencies.
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.