@jsonjoy.com/fs-fsa

Project backingcaution

The repository is owned by a user rather than an organization, so the concentrated contributor activity is not visibly buffered by organizational backing. Other repository activity still shows active maintenance.

Repo bus factorcaution

Three contributors were active, but the top contributor made about 90% of recent commits. That concentration is a meaningful continuity concern, even though other contributors remain active.

Repo toolingcaution

TypeScript and npm build tooling are present, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene gap, not evidence of abandonment.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection findings. However, all five action references are unpinned, one workflow has top-level write permissions, and a high-confidence low-severity finding reports installing a package outside a lockfile.