@npmcli/redact

Licensecaution

The artifact declares ISC but its license file is detected as MIT, creating a licensing ambiguity despite both the artifact and repository containing license files.

Repo bus factorcaution

All recent commits came from one contributor, concentrating current maintenance responsibility; organization backing helps, but no second recent contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, indicating limited recent development activity even though the repository has not been abandoned.

Workflow auditcaution

All nine workflows were analyzed, but all 41 action references are unpinned and four workflows grant top-level write permissions. High-confidence template-injection findings and a medium-confidence bot-condition finding add workflow hygiene concerns, although no untrusted checkout or script-injection sink was detected.