ast-v8-to-istanbul

Workflow auditdanger

Both workflows were analyzed and scope jobs locally, with no untrusted checkout or script-injection trigger. However, the publish workflow has a high-confidence template-injection finding, and all three action references are unpinned; the latter is a smaller reproducibility risk.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-contributor maintenance concentration has no shown organizational handoff support.

Repo bus factorcaution

All nine recent commits came from one contributor, leaving maintenance dependent on a single person.

Repo toolingcaution

The repository uses TypeScript, Vitest, Vite, Rollup, Babel, and npm scripts, but no security-scanning tooling was detected. The build setup is mature, while security coverage is a gap.

Security policycaution

No security policy is present in the repository, reducing transparency about how vulnerabilities should be reported and handled.