@esbuild/openharmony-arm64

Repo bus factorcaution

One contributor made about 91% of recent commits, leaving maintenance heavily concentrated despite three additional contributors being active.

Repo package mentioncaution

The linked repository does not match the package name and its README does not mention this package. The README does identify it as an OpenHarmony shim for esbuild, which partly explains the mismatch but does not remove the transparency concern.

Repo toolingcaution

The project uses build tooling, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The linked repository has no security policy, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

All four workflows were analyzed and all references are pinned, but the audit found a high-severity cache-poisoning pattern at low confidence, a high-confidence archived action, and repeated ad hoc package installs; one publish workflow also grants top-level write permissions.