data-uri-to-buffer

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance concern despite the recent push timestamp elsewhere.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it; although a monorepo name mismatch can be normal, the lack of a package mention makes ownership less transparent.

Repo toolingcaution

The project uses TypeScript, Vitest, Turbo, and npm scripts, but no security scanning tools were detected; the missing scanning is a modest transparency gap.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance undocumented.

Workflow auditcaution

All 13 analyzed action references are unpinned, weakening build reproducibility. The audit also found high-severity cache-poisoning patterns only at low confidence and a high-confidence low-severity adhoc package installation, so these are workflow hygiene concerns rather than standalone severe risk.