@colordx/core

Repo bus factorcaution

One contributor made 100% of the 106 commits in the last three months. The project is active, but maintenance continuity depends heavily on a single person.

Repo toolingcaution

The project uses TypeScript, Vitest, tsup, npm scripts, and esbuild, but no security-scanning tools were detected. The build and test tooling is solid, while security visibility is thinner.

Security policycaution

The repository has no security policy. For a library, this is a transparency and vulnerability-reporting gap, though it does not outweigh the active development evidence.

Workflow auditcaution

Both workflows were analyzed without high- or medium-severity findings, and no untrusted checkout or script-injection paths were found. All 6 action references are unpinned, and the release workflow installs a package outside a lockfile, creating moderate reproducibility and workflow-hygiene concerns.