@whatwg-node/server

Project backingcaution

The repository owner is an individual rather than an organization, so the concentrated contributor activity is not offset by explicit organizational ownership.

Repo bus factorcaution

Four contributors were active, but one contributor made 86% of recent commits; that concentration creates some continuity risk despite the presence of other contributors.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and handling expectations less transparent for users and maintainers.

Version stabilitycaution

Version 0.13.0 is not a prerelease, but the recent prerelease share is 0.9 and the package remains below major version 1, so API stability may be less predictable.

Workflow auditcaution

All five workflows were analyzed with no untrusted checkouts or script injection, and permissions are not broadly writable. However, four high-confidence unpinned-image findings and 14 of 36 unpinned action references leave build reproducibility and workflow supply-chain hygiene weaker.