@npmcli/fs

Repo bus factorcaution

All recent commits came from one contributor, creating a concentrated maintenance path. Organization backing partly offsets the risk because responsibility can be handed off internally.

Repo commit activitycaution

Only one commit was recorded in the last three months, by one active maintainer. That is real recent activity, but it indicates a thin current maintenance pace.

Workflow auditcaution

All eight workflows were analyzed, but all 38 action references are unpinned and four workflows grant top-level write permissions. High-confidence template-injection findings and a medium-confidence bot-condition finding add workflow hygiene risk, although no untrusted checkout or script-injection sink was reported.