@docusaurus/utils-validation

Repo bus factorcaution

One contributor made about 97% of the 77 recent commits, leaving maintenance unusually concentrated even though two other contributors were active.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which is normally a caution; here the organization-backed Docusaurus monorepo context makes a sub-package relationship plausible but does not fully remove the transparency gap.

Workflow auditcaution

All 17 workflows were analyzed with no untrusted checkouts, script-injection counts, or unpinned actions, and most use read-only permissions. High-confidence template-injection findings and trusted-publishing/adhoc-package findings leave a workflow-hygiene concern, although no dangerous trigger-and-sink combination was reported.