zero-to-prod/data-model-helper

Maintainerscaution

One registry publishing maintainer indicates a thin publishing base; the linked repository is user-owned rather than organization-owned, so there is no organizational backing shown to compensate.

Project backingcaution

The registry namespace and repository owner match, but the owner is a user account, so the signals show package continuity without organizational backing.

Release historycaution

The package has 36 releases over about 700 days, but only one release in the last 12 months; the recent cadence suggests maintenance has slowed.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, a concrete sign that maintenance has paused after the latest release.

Workflow auditcaution

All five workflows were analyzed, but all seven action references are unpinned, one workflow has broad top-level write permissions, and two high-confidence template-injection findings were reported in annotate.yml. No untrusted checkout or pull_request_target trigger was found, so these are workflow-hygiene concerns rather than a standalone severe risk.