@npmcli/query

Repo bus factorcaution

All recent commits came from one contributor. The organization-owned repository provides some ability to hand off maintenance, but no second active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, indicating limited recent development activity and lowering confidence in ongoing maintenance.

Workflow auditcaution

All 38 action references are unpinned, and four workflows grant top-level write access; high-confidence template-injection findings and a medium-confidence bot-condition finding add workflow hygiene risk. The audit found no untrusted checkout or script-injection sink, and the organization backing limits the severity.