@stryker-mutator/api

Repo bus factorcaution

One contributor made about 72% of the 18 recent commits, creating concentration risk, although four other contributors were active and the repository is organization-owned.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, which makes package-to-repository mapping less explicit; the API-focused README and organization ownership provide partial context.

Repo toolingcaution

TypeScript and npm build tooling are present, but no security-scanning tools were detected; the provenance and active repository partly compensate, but transparency is weaker.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All four workflows were analyzed, but all 10 action references are unpinned, one workflow contains a script-injection finding, and two high-confidence template-injection findings were reported. No dangerous trigger or untrusted checkout was found, so this is workflow hygiene and supply-chain caution rather than a standalone severe risk.