@buape/carbon

Dangerous workflowscaution

One pull_request_target workflow exists, but no untrusted checkouts or script-injection patterns were detected across the five analyzed workflows.

Repo bus factorcaution

Four contributors were active, but one account made about 83% of the recent commits; the organization backing provides some handoff capacity, but activity remains concentrated.

Repo issue activitycaution

The repository has recent issues and pull requests, but it closed no issues and merged only one pull request in the last month, indicating some unresolved maintenance workload.

Token permissionscaution

Four workflows lack top-level token permissions and one workflow requests top-level write access, leaving broader-than-necessary GitHub Actions permissions as a supply-chain hygiene concern.

Version stabilitycaution

Version 0.16.0 is not marked as a prerelease, but the recent prerelease share is 100%, so the pre-1.0 API may still change frequently.