css-select

Project backingcaution

The repository is owned by an individual rather than an organization, so the single active maintainer and concentrated contribution pattern carry more weight.

Repo bus factorcaution

All recent commits came from one contributor, leaving maintenance dependent on a single active developer; the long project history and recent merged pull requests provide only partial compensation.

Repo commit activitycaution

Only one commit was recorded in the last three months, so direct development activity is currently sparse even though recent pull requests were merged.

Security policycaution

No security policy was found in the repository, leaving vulnerability-reporting expectations unclear; CodeQL and Dependabot provide some compensating security coverage.

Workflow auditcaution

All four workflows were analyzed, but all 10 action references are unpinned and one high-confidence bot-condition finding affects Dependabot automation. The cache-poisoning finding is low confidence, and no untrusted checkout or script injection was found.