@xhmikosr/decompress-tar

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated recent contribution activity is less easily mitigated by organizational handoff.

Repo bus factorcaution

All three recent commits came from one contributor, creating a meaningful continuity risk for a project owned by an individual.

Security policycaution

No repository security policy is present. This is a transparency gap, but it is partly offset by the repository's CodeQL scanning.

Workflow auditcaution

All three workflows were analyzed with no injection or high-severity findings, and permissions are scoped in two workflows. However, all 8 action references are unpinned, leaving avoidable workflow supply-chain exposure.