builder-util-runtime

Repo bus factorcaution

One contributor made about 89% of the 81 recent commits. Five others contributed, but their much smaller shares leave maintenance unusually concentrated.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention builder-util-runtime, so the package-to-source relationship is not directly transparent despite the normal monorepo possibility.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All nine workflows were analyzed, with no untrusted checkout or script-injection paths and no unpinned actions. One high-confidence low-severity finding reports an install outside a lockfile, a minor reproducibility concern; two workflows also grant top-level write access.