ast-kit

Maintainerscaution

Only one registry account can publish the package, which creates publishing continuity risk, though the repository shows that this maintainer is currently active.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated maintainer and contributor base is a genuine continuity concern.

Repo bus factorcaution

One contributor made all five commits in the last three months, leaving no demonstrated backup contributor and making continuity dependent on one person.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear; the available security scanning partly offsets this transparency gap but does not replace a policy.

Workflow auditcaution

All three workflows were analyzed with no injection findings or dangerous triggers, and permissions are scoped at job level where applicable. However, all five action references are unpinned, weakening build reproducibility.