@npmcli/promise-spawn

Repo bus factorcaution

One contributor made 100% of the recent commits. Organization backing provides some handoff capacity, but no second active contributor is shown in this period.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, indicating thin recent maintenance activity despite the release history.

Workflow auditcaution

All 38 action references are unpinned, and four workflows grant top-level write access; high-confidence template-injection findings are present, although no untrusted checkout or script-injection sink was found.