zero-to-prod/url-cli

Maintainerscaution

A single registry maintainer creates some continuity risk, although the linked repository and release history show this is an individually maintained project rather than an unowned package.

Project backingcaution

The repository owner is a user account rather than an organization, so the single publisher and limited contributor evidence are not offset by visible organizational backing.

Release historycaution

The package has made no registry release in about 19 months, after five releases in its first month. That prolonged release silence raises abandonment risk despite the repository remaining available.

Repo commit activitycaution

There were no commits or active maintainers in the last three months, consistent with the long release gap. This weakens evidence of ongoing maintenance.

Workflow auditcaution

All 13 analyzed action references are unpinned, creating avoidable build-integrity risk. The audit also found high-confidence template-injection findings and a script-injection finding in annotate.yml; the low-confidence GITHUB_ENV finding is only a hygiene concern here because no untrusted checkout was reported.