cspell-config-lib

Repo bus factorcaution

One contributor made about 87% of recent commits, which is concentrated, but nine active contributors and organization ownership provide some handoff capacity.

Repo package mentioncaution

The repository name does not match this package and its README does not mention cspell-config-lib, so the package's association with the linked monorepository is not explicit. This is a transparency concern even though name mismatches can occur for subpackages.

Workflow auditcaution

The audit found a high-confidence high-severity github-app issue where an app token inherits blanket installation permissions. Four workflows have top-level write access, and only 30 of 37 workflows were analyzed, although no untrusted checkout or script-injection paths were found.