zero-to-prod/spapi-tokens

Maintainerscaution

One registry publishing maintainer is a modest transparency and continuity concern for a user-owned project. The linked repository is maintained under the same named owner, which provides some consistency but not a broad maintainer base.

Release historycaution

The package has 14 releases over about 20 months, but none in the last 12 months and the latest registry release was about one year ago, indicating a meaningful maintenance slowdown.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. This is partly offset by a repository push in April 2026 and a recent historical release, but current development activity is still weak.

Repo popularitycaution

The repository has 1 star, 0 forks, and 1 watcher. Popularity is only supporting evidence, but these low counts provide little external evidence of broad adoption or review.

Workflow auditcaution

All 7 analyzed action references are unpinned, and the audit reports two high-confidence template-injection findings in annotate.yml. No untrusted checkout or dangerous trigger was reported, so this is workflow hygiene risk rather than a severe standalone dependency risk.