@rollup/rollup-android-arm64

Repo bus factorcaution

One contributor made about 95% of recent commits, creating concentration risk, although the repository is organization-owned and two other maintainers were active.

Repo package mentioncaution

The repository name and README do not identify this package, so the link is less explicit; this is partly expected for an architecture-specific package in a monorepo but remains a transparency caution.

Workflow auditcaution

All six workflows were analyzed and all 59 action references are pinned, but a high-confidence template-injection finding occurs in a workflow_run workflow and an untrusted checkout is present; low-confidence cache findings and ad hoc package installation add hygiene concerns.