@whatwg-node/promise-helpers

Repo bus factorcaution

One contributor made about 86% of the recent commits, so maintenance is concentrated despite three additional contributors being active. The concentration is a real continuity concern for this user-owned repository.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package, so the package-to-repository relationship is not clearly demonstrated. This is a transparency concern even though a monorepo can legitimately contain differently named packages.

Security policycaution

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap, although active development and Dependabot provide some compensating maintenance evidence.

Version stabilitycaution

Version 2.0.0 is a stable major release and is not a prerelease. However, 95% of recent releases are prereleases, adding some release-process uncertainty.

Workflow auditcaution

All five workflows were analyzed without untrusted checkouts or script injection, but four high-confidence findings identify unpinned container images and 14 of 36 action references are unpinned. These weaken build reproducibility and supply-chain hygiene without showing an immediate release-path compromise.