zero-to-prod/spapi-lwa-sdk

Release historydanger

Only three releases have been published, with no releases in the last 12 months and the latest release over a year ago. This is meaningful evidence of stalled maintenance for a package intended as an SDK.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, leaving current maintenance capacity unclear and increasing abandonment risk.

Workflow auditcaution

All seven analyzed action references are unpinned, and the audit found a high-confidence script-injection issue plus high-confidence template-injection findings in annotate.yml. The absence of pull_request_target and workflow_run triggers limits the risk, but the workflow still needs remediation.