@rollup/rollup-darwin-arm64

Repo bus factorcaution

Commit activity is highly concentrated: one contributor made about 95% of the 60 recent commits. The organization-owned project provides some handoff capacity, but this remains a maintenance continuity concern.

Repo package mentioncaution

The repository name does not match this platform-specific package and its README does not mention the package, which is a transparency concern; the organization-backed Rollup monorepo context makes a subpackage mismatch understandable but does not remove the gap.

Workflow auditcaution

All six workflows were analyzed and all 59 action references are pinned, but a high-confidence template-injection finding occurs in a workflow_run workflow and an untrusted checkout occurs in a pull_request_target workflow. These workflow risks warrant caution even though the audit found no script injection and most permissions are read-only.