@esbuild/android-arm64

Repo bus factorcaution

One contributor made about 91% of the last three months' commits, leaving maintenance heavily concentrated. Three additional contributors were active, but each contributed only one commit, so they provide limited practical redundancy.

Repo package mentioncaution

The repository name and README do not mention this platform package, which creates some ownership ambiguity. The artifact README explicitly directs consumers to the esbuild repository, so this is a limited concern consistent with a platform-specific package rather than a strong mismatch.

Security policycaution

The linked repository has no security policy. That weakens vulnerability-reporting transparency, although it is a governance gap rather than evidence that the release is unsafe.

Workflow auditcaution

All four workflows were analyzed and all 19 action references are pinned, with no untrusted checkout or script-injection path. However, the audit found a high-severity cache-poisoning pattern at low confidence, an archived action with high confidence, and several high-confidence ad hoc package installs; one publish workflow also grants top-level write permissions.