zero-to-prod/factory
The package has useful documentation, tests in its repository, release notes, licensing, and a security policy. Recent development is quiet, and the workflows contain high-confidence injection findings plus entirely unpinned actions.
58%
Total Score
50
100
88
100
Health Score Breakdown
The package is about 581 days old with 11 releases, but only one release occurred in the last 12 months, indicating a slow current cadence.
The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign that maintenance has currently gone quiet.
There are no open issues or pull requests and no recent issue or pull-request activity; this is consistent with a small project but provides little evidence of active community maintenance.
This is a non-prerelease v0.5.0 release, which is stable for its version line but remains below a stable major version and may carry more API-change risk.
All five workflows were analyzed, but one has a high-confidence template-injection finding and one script-injection finding; all seven action references are unpinned. The risky workflow has no pull_request_target or workflow_run trigger, so these are workflow-hygiene concerns rather than a demonstrated severe exposure.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 David Smith |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 zero-to-prod/arr Version ^1.1 | — | — |
zero-to-prod/package-helper Version ^1.1.3 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.