@ioredis/commands

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security scanning tool was detected; this is a minor transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving reporting and response expectations undocumented; this is a modest transparency gap for an otherwise active project.

Workflow auditcaution

All three workflows were analyzed without dangerous triggers or untrusted checkouts, and one scopes permissions at job level. However, all four action references are unpinned and the release workflow installs a package outside a lockfile, creating minor CI reproducibility and supply-chain hygiene concerns.