worksome/envy

Release historycaution

The package has existed for about 4 years with 15 releases, but only 1 release in the last 12 months compared with a historical median interval of about 50 days. This indicates a materially slower release pace, though the assessed version is recent.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. The recent release and repository push provide some evidence of ongoing ownership, but they do not offset the lack of recent development activity.

Workflow auditcaution

All 9 analyzed action references are unpinned, and the audit found a high-confidence bot-condition issue in the Dependabot auto-merge workflow. The pull_request_target workflow has no untrusted checkout or script-injection findings, so this is a hygiene concern rather than a severe supply-chain risk.