@stryker-mutator/core

Dependency profilecaution

The package has 26 runtime dependencies, including several internal Stryker components and testing-related libraries. This is a meaningful dependency surface but is consistent with a feature-rich mutation-testing tool.

Repo bus factorcaution

One contributor made about 72% of the 18 recent commits, which creates concentration risk. However, four other contributors were active and the repository is organization-owned, providing some handoff capacity.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security-scanning tools were detected. This is a modest transparency and defense-in-depth gap rather than evidence of abandonment.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unclear for a package with a substantial dependency and build surface.

Workflow auditcaution

All four workflows were analyzed, but CI contains one high-confidence script-injection audit finding and all 10 action references are unpinned. The injection is not paired with a pull_request_target or workflow_run trigger, so these are workflow-hygiene concerns rather than a severe standalone risk.