ast-types

Repo bus factorcaution

Two contributors were active, but one made 15 of 16 recent commits, leaving maintenance heavily dependent on a single person.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

Both workflows were analyzed completely, with no untrusted checkout or script-injection trigger; however, all four action references are unpinned, and the release workflow has high-confidence template-injection and adhoc-package findings, creating workflow hygiene concerns.