@whatwg-node/events

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated contributor activity is less readily offset by formal organizational handoff capacity.

Repo bus factorcaution

One contributor made about 89% of the 38 recent commits, leaving maintenance heavily concentrated despite three additional contributors being active.

Security policycaution

The repository has no security policy. This is a transparency gap for a package that supplies foundational event behavior, although active development and dependency scanning partly compensate.

Version stabilitycaution

The current release is not marked prerelease, but all recent releases are prereleases and the package remains on major version 0. This adds some stability uncertainty despite the absence of a prerelease marker on this version.

Workflow auditcaution

All five workflows were analyzed successfully with no untrusted checkouts or script injection; however, four high-confidence findings report unpinned container images, leaving a build reproducibility and workflow hygiene gap.