@docusaurus/utils-common

Repo bus factorcaution

One contributor made about 97% of recent commits, a concentration risk, but the repository is organization-owned and two other contributors were active during the period, partly compensating for it.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, which creates a repository-association transparency concern. The package is part of an organization-owned Docusaurus repository, which partly explains the monorepo naming mismatch.

Workflow auditcaution

All 17 workflows were analyzed, all 76 action references are pinned, and no untrusted checkout or script-injection sink was found. High-confidence template-injection findings and several high-confidence ad hoc package installs remain workflow hygiene concerns, while the trusted-publishing finding is informational.