@mapbox/jsonlint-lines-primitives

Repo bus factorcaution

One contributor made all two recent commits, concentrating current maintenance responsibility. Organization ownership provides some ability to hand work off, but no second active contributor is shown.

Repo commit activitycaution

The repository had two commits in the last three months, so it is not inactive, but the observed activity is limited.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, so the package-to-repository relationship is not clearly established. The package README does describe it as a Mapbox GL JS fork, which partially explains the mismatch but does not remove the transparency gap.

Repo toolingcaution

The repository uses Make for builds, but no security scanning tools were detected. The missing scanning is a modest transparency gap rather than evidence of abandonment.

Workflow auditcaution

Both workflows use all four analyzed actions without pinning, and one release workflow grants top-level write permissions. The two cache-poisoning findings are low-confidence hygiene alerts, so they do not independently indicate a severe workflow risk.