@photo-sphere-viewer/core

Project backingcaution

The repository owner is an individual account rather than an organization, so the single registry maintainer and concentrated commit activity have less organizational redundancy to offset them.

Repo bus factorcaution

One contributor made about 70% of the 23 recent commits, so maintenance is concentrated. Three additional contributors were active, partially reducing but not eliminating the continuity risk.

Security policycaution

The repository has no SECURITY.md policy. This is a transparency and vulnerability-reporting gap, although it does not indicate that the package is unsafe.

Workflow auditcaution

All 15 analyzed action references are unpinned, and the audit reports high-confidence template-injection findings in milestone and release workflows. Top-level write permissions also appear in 3 workflows, but no untrusted checkout or script-injection trigger was found, limiting the impact to workflow hygiene rather than a severe package-health risk.