@npmcli/metavuln-calculator

Repo bus factorcaution

All one recent commit came from a single contributor, concentrating current activity; organization ownership makes handoff more plausible than for an unaffiliated project, but does not remove the maintenance concern.

Repo commit activitycaution

The repository recorded only one commit in the last three months, which is sparse for an actively maintained dependency, although the recent release and organization backing provide some compensation.

Repo issue activitycaution

Only two issues and three pull requests are open, but there were no new or closed issues or merged pull requests in the last month, providing little evidence of current activity.

Type declarationscaution

No type declarations are published, which makes integration less convenient for TypeScript consumers, though this is a consumer-ergonomics gap rather than an abandonment signal.

Workflow auditcaution

All eight workflows were analyzed, but all 38 action references are unpinned and four workflows grant top-level write permissions. High-confidence template-injection findings and a medium-confidence bot-condition finding add workflow hygiene risk, though no untrusted checkout or script-injection sink was found.