@gerrit0/mini-shiki

Maintainerscaution

Only one registry account has publish access. This is not conclusive because registry access lists do not measure actual development, but it leaves little publishing redundancy alongside the recent lack of commits.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Regular registry releases partly offset this, but the lack of recent source activity lowers maintenance confidence.

Security policycaution

The repository has no security policy. This is a transparency and response-process gap, though it is less serious because the package has provenance and no install lifecycle scripts.

Workflow auditcaution

All seven analyzed action references are unpinned, and the publish workflow installs a package outside a lockfile with high confidence; one workflow also grants top-level write access. These are avoidable release-hygiene weaknesses, though no untrusted checkout or script-injection path was found.