@napi-rs/canvas-linux-x64-musl

Project backingcaution

The repository owner is an individual account rather than an organization, so the concentrated contributor activity has less organizational handoff support.

Repo bus factorcaution

The top contributor made about 73% of recent commits, which is concentrated, but two other contributors remain active and the project has current release activity.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so the package-to-repository relationship is less transparent. The platform-binary naming makes a monorepo relationship plausible, but it is not demonstrated by this signal.

Workflow auditcaution

All 4 workflows were analyzed with no untrusted checkout or script-injection findings, but all 96 action uses are unpinned and two workflows grant top-level write permissions. The cache-poisoning findings are low confidence, while adhoc package installation is a smaller high-confidence hygiene concern.