@mongodb-js/zstd

Lifecycle scriptscaution

An install lifecycle script is present, which is expected for a native Node.js addon that may need platform-specific setup, but it increases installation complexity.

Repo bus factorcaution

All recent commits came from one contributor, creating concentration risk; the organization-owned project provides some capacity to hand work off, so this is a moderate concern rather than a severe one.

Repo commit activitycaution

Only four commits were recorded in the last three months, with one active maintainer, indicating modest recent activity rather than a broad maintenance stream.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less clear for consumers of a native addon.

Workflow auditcaution

All six workflows were analyzed with no untrusted checkout or script-injection findings. Two high-confidence low-severity findings install packages outside lockfiles, 20 of 41 action references are unpinned, and one release workflow has top-level write permissions, creating moderate workflow hygiene concerns.