The package is easy to inspect, narrowly scoped, and clearly licensed. Its long release gap and single-contributor maintenance leave limited evidence of sustained support, so pin this exact version and monitor the repository.
64%
Total Score
50
100
92
75
This is the sole release, published nearly six years ago, with no releases in the last 12 months. Recent repository activity partly offsets the age, but registry maintenance evidence remains thin.
All recent commits came from one contributor, so maintenance is concentrated and continuity depends heavily on that person.
One commit was made in the last three months by one active maintainer, showing current activity but only limited evidence of sustained maintenance capacity.
The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.
All analyzed action references are pinned and the audit found no untrusted checkouts, injections, or findings. Both workflows grant top-level write permissions, which is broader than necessary but not severe without an untrusted trigger.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.