worksome/sdk

Release historycaution

The package has five releases over about three years, but none in the last 12 months; the latest release was about 17 months ago. This indicates slowing maintenance despite the repository remaining active.

Repo commit activitycaution

The repository recorded two commits in the last three months, showing some ongoing work, but the pace is modest and does not offset the lack of registry releases in the past year.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a modest transparency gap for an API client library.

Version stabilitycaution

Version v0.1.4 is a normal, non-prerelease release, but it is still below 1.0, so API stability may be less established than for a mature major release.

Workflow auditcaution

All eight action references are unpinned, and the audit found a high-confidence bot-condition issue in a pull_request_target workflow; that workflow also has top-level write permissions. No untrusted checkout or script injection was found, limiting the risk to a meaningful hygiene concern rather than a severe finding.