web-vision/wv_file_cleanup

Release historycaution

The package has only three releases, all clustered on June 19, 2024, with no registry release in the last 12 months. Recent repository activity partly offsets the abandonment concern but does not explain the stale registry cadence.

Repo bus factorcaution

All 10 recent commits came from one contributor, concentrating maintenance responsibility. Organization backing provides some handoff capacity, but no second active contributor is shown.

Version stabilitycaution

Version 2.0.1 is a stable major release, but the registry reports 1.0.1 as latest, creating a transparency and publication-consistency concern.

Workflow auditcaution

All 16 analyzed action references are unpinned, and the publish workflow has two high-confidence template-injection findings. The workflows have no untrusted checkout or script-injection trigger, so this is a hygiene concern rather than a severe standalone risk.