xmo/mine-core

Dangerous workflowscaution

One of two workflows uses pull_request_target, which requires careful review because it runs with repository context. No untrusted checkout or script-injection pattern was detected, limiting the risk.

Dependency profilecaution

The package declares 49 runtime dependencies, including many framework and extension integrations. That breadth is plausible for a core framework package, but it increases upgrade and transitive-dependency maintenance burden.

Package scaffoldingcaution

The artifact includes a README, and the repository has tests and uses GitHub releases, which compensate for the absence of tests and a changelog in the published artifact. The README is only 77 characters and still instructs users to install a ^1.x range for v2.0.3, so consumer guidance is weak.

Release historycaution

The project has 25 releases and historically released about every 5 days, but it has published no registry release in roughly 2 years and 2 months. That makes the assessed release look stale despite the earlier cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. Combined with the lack of registry releases for roughly 2 years, this is the strongest maintenance concern.