zero-to-prod/omdb-models

Repo commit activitydanger

The repository recorded no commits and no active maintainers in the last three months, consistent with a project whose activity has stopped for over a year. This is a meaningful abandonment concern.

Dependency profilecaution

The package declares eight runtime dependencies for its data models and factories. This is a substantial dependency surface, though the collected signal does not show problematic or excessive dependencies.

Project backingcaution

The registry namespace and repository are owned by the same individual account, providing a clear ownership link but not the resilience of organization backing.

Release historycaution

The package has eight releases over about 21 months, with a median interval of about 6 days, but no releases in the last 12 months. The recent pause weakens confidence in ongoing maintenance.

Workflow auditcaution

All five workflows were analyzed, but all seven action references are unpinned. The audit also found two high-confidence template-injection findings and one script-injection finding in annotate.yml; no untrusted checkout or dangerous trigger was reported, so these are serious hygiene concerns rather than standalone proof of compromise.