@node-llama-cpp/linux-arm64

Repo bus factorcaution

All 15 recent commits came from one contributor, creating a meaningful continuity risk; organization backing partly offsets the risk because maintenance can be handed off.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so the package-to-repository relationship is less transparent; the mismatch may still be normal for a platform-specific package.

Repo toolingcaution

The project uses established build and test tools, but no security-scanning tool was detected, leaving a modest transparency gap.

Security policycaution

The repository has no security policy, which weakens vulnerability-reporting transparency, though this is not evidence of abandonment by itself.

Workflow auditcaution

The audit found no untrusted checkout or script-injection path, and two workflows scope permissions at job level. However, all 51 action references are unpinned and a high-confidence low-severity finding reports an ad hoc package install, so workflow supply-chain hygiene is weaker than ideal.