@newrelic/native-metrics

Repo bus factorcaution

All four recent commits came from one contributor, leaving maintenance dependent on a single active individual. Organization backing provides some handoff capacity but does not remove the concentration risk.

Repo commit activitycaution

Four commits in the last 3 months show recent activity, but the pace is modest for a native dependency. The recent release partly offsets that concern.

Workflow auditcaution

All six workflows were analyzed, but 36 of 40 action references are unpinned, and the audit found a high-confidence template-injection issue plus high-confidence ad hoc package installation; low-confidence cache findings are hygiene concerns. The pull_request_target trigger has no untrusted checkout or script-injection sink, so it is not severe on its own.