bytestreamjs

Release historycaution

The package has 23 releases and a roughly six-day median interval, but its latest registry release was about four years ago with no releases in the last 12 months. Recent repository activity partly offsets the age, but the published release line is stale.

Repo bus factorcaution

Two contributors were active, but one made 7 of 9 recent commits. Organization backing and a second active contributor reduce the risk, though activity remains concentrated.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the package-to-source relationship is less transparent than expected. The mismatch is not explained by a monorepo indication in the provided evidence.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. The presence of Snyk scanning provides some compensation but does not replace a policy.

Workflow auditcaution

Both workflows were analyzed, but all 9 action references are unpinned, and release.yml has a high-confidence template-injection finding plus top-level write permissions. The finding is hygiene rather than proof of exploitation, but the combined release-workflow exposure warrants caution.