@napi-rs/lzma

lzma / lzma2 / xz compression for Node.js and the browser, backed by pure-Rust lzma-rust2 via https://napi.rs

Latest 1.5.1

NPM

83%

Total Score

healthy

Healthy—active maintenance and recent provenance outweigh workflow pinning and security-policy gaps.

Health Score Breakdown

Project backing

The repository is owned by a user rather than an organization, so the small active contributor base is not supplemented by clear organizational handoff capacity. Recent activity and two active contributors partly compensate.

Repo tooling

The project uses TypeScript and npm-based build tooling, but no security-scanning tools were detected. The missing scanning is a modest hygiene gap rather than evidence of abandonment.

Security policy

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures less transparent for consumers.

Workflow audit

The workflow audit completed fully and found no untrusted checkout or script-injection path, with job-level permissions in use. However, all 29 action references are unpinned and a high-confidence low-severity finding reports installing a package outside a lockfile; the repeated low-confidence cache findings are hygiene only.