alphanum-sort

Repo bus factorcaution

One contributor made 7 of 8 recent commits, leaving maintenance concentrated despite a second active contributor. This is a modest continuity concern for a user-owned project.

Repo toolingcaution

No build tool or security scanning tool was detected. This is a hygiene gap, but the small package has recent releases, CI workflows, and provenance that partly compensate.

Workflow auditcaution

Both workflows were analyzed, but all 4 action references are unpinned, one workflow grants top-level write permissions, and a high-confidence adhoc-packages finding reports installation outside a lockfile. The low-confidence cache-poisoning finding is hygiene only, and no untrusted checkout or script-injection path was found.