cacache

Repo bus factorcaution

All recent commits came from one contributor, creating concentrated maintenance risk. Organization ownership provides some ability to hand maintenance off, so this is a caution rather than a severe risk.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, indicating thin recent development activity. The recent release history partly compensates, but this still lowers maintenance confidence.

Workflow auditcaution

All workflows were analyzed, but all 38 action references are unpinned, four workflows grant top-level write permissions, and high-confidence template-injection findings were reported in two workflows; these are meaningful workflow hygiene concerns. The findings are not paired with pull_request_target, workflow_run, or untrusted checkout counts, which limits their severity.