@npmcli/name-from-folder

Repo bus factorcaution

All three-month commit activity came from one contributor, creating concentration risk; the npm organization owns the repository, which provides some ability to hand maintenance off.

Repo commit activitycaution

Only one commit was recorded in the last three months, showing limited recent activity; the recent release provides some compensation but does not establish a broad maintenance cadence.

Workflow auditcaution

All eight workflows were analyzed, but all 38 action references are unpinned, four workflows grant top-level write permissions, and high-confidence template-injection findings were reported in pull-request and release workflows. No untrusted checkout or script-injection sink was found, limiting the severity.