builder-util

Repo bus factorcaution

One contributor made about 89% of the recent commits, creating concentration risk; organization ownership and five other active contributors partly compensate for it.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention builder-util, creating some uncertainty about package-to-repository ownership; the organization-backed repository and package contents provide partial context but do not remove it.

Security policycaution

No repository security policy was found, leaving disclosure guidance and security contact expectations less transparent.

Workflow auditcaution

All 9 workflows were analyzed with no untrusted checkout or script-injection findings, all 36 action references are pinned, and most workflows use read-only permissions. A high-confidence low-severity finding reports an out-of-lockfile package install, and two workflows have top-level write permissions, so workflow hygiene is slightly weaker but not severe.