@jsonjoy.com/fs-core

Repo bus factorcaution

One contributor made about 90% of the last three months' commits, leaving a meaningful continuity risk despite two additional active contributors.

Repo toolingcaution

The project uses TypeScript and npm scripts, but no security-scanning tooling was detected; the repository's SECURITY.md provides some compensating transparency.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection findings, but all five action references are unpinned, one workflow has top-level write permissions, and a high-confidence audit found an ad hoc package install.