@chevrotain/utils

Repo bus factorcaution

All 14 recent commits came from one contributor, creating a meaningful continuity risk despite organization ownership.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it; although the organization context makes a monorepo subpackage plausible, package ownership is less explicit.

Repo toolingcaution

The project uses TypeScript, Turbo, and npm scripts, indicating an established build process, but no security scanning tools were detected.

Security policycaution

No repository security policy was found, reducing transparency around vulnerability reporting and response.

Workflow auditcaution

All two workflows were analyzed without untrusted checkouts or script injection, but all 7 action uses are unpinned and the release workflow has low-confidence cache-poisoning findings plus top-level write permissions.