Documentation and project structure are strong, with tests, a changelog, and a security policy. The single-release history and no commits in the last three months leave maintenance maturity uncertain, while unpinned workflow actions weaken build reproducibility.
62%
Total Score
50
100
86
100
The registry and repository are owned by the same individual account, so ownership is consistent, but there is no organization backing shown to compensate for the thin maintenance history.
This package has only one release since January 10, 2026, so there is little evidence of an established release cadence or long-term maintenance.
There were zero commits and zero active maintainers in the last three months, which weakens evidence of ongoing maintenance for a package with only one release.
The assessed version is v0.1.0 and is not a stable major release, which indicates an early API and a higher chance of breaking changes.
The workflow audit completed fully with no detected dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 10 action references are unpinned, reducing build reproducibility and update integrity.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.