color-parse

Repo bus factorcaution

One contributor made all eight commits in the last three months, creating a real continuity risk. Organization ownership provides some capacity to hand maintenance off, but no second recent contributor is shown.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response. This is a maintenance and governance gap, not evidence that the package is malicious.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous sinks or audit findings, but both action references are unpinned. That leaves routine workflow supply-chain hygiene weaker than it could be.