@napi-rs/canvas-darwin-arm64

Project backingcaution

The repository owner is an individual rather than an organization, so the concentrated contributor activity is a genuine continuity concern rather than clearly supported by organizational backing.

Repo bus factorcaution

One contributor made about 73% of recent commits, which concentrates maintenance, but two additional contributors were active during the same period and the repository is actively maintained.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, leaving the package-to-repository relationship less explicit. This may be normal for a platform subpackage, but it remains a transparency caution.

Workflow auditcaution

All 4 workflows were analyzed with no untrusted checkouts or script-injection findings, but all 96 action references are unpinned and two workflows grant top-level write permissions. The low-confidence cache findings are hygiene concerns, while high-confidence adhoc package installs add a smaller reproducibility concern.