@chevrotain/regexp-to-ast

Repo bus factorcaution

All 14 recent commits came from one contributor, leaving maintenance dependent on a single active developer despite organization ownership.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so package ownership is less directly verifiable; the organization monorepo context partly explains the mismatch.

Repo toolingcaution

The project uses TypeScript, Turbo, and npm scripts, but no security-scanning tooling was detected; this is a modest transparency gap.

Security policycaution

No repository security policy was found, reducing clarity about vulnerability reporting and response.

Workflow auditcaution

All 7 action references are unpinned and one workflow grants top-level write access. The audit also reported low-confidence cache-poisoning patterns in the release workflow, which are hygiene concerns rather than conclusive exploitation evidence.