dmg-builder

Repo bus factorcaution

One contributor made about 89% of the 81 recent commits, creating concentration risk. The organization-owned project and five additional active contributors partly compensate, so this is a caution rather than a severe abandonment signal.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which creates some package-to-repository identity ambiguity. The package is a utility used by electron-builder, so the mismatch is consistent with a monorepo or subpackage relationship but remains a transparency caution.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations and response procedures less transparent.

Workflow auditcaution

All nine workflows were analyzed with no high- or medium-severity findings, all 36 action references are pinned, and most workflows use read-only permissions. A high-confidence low-severity adhoc-packages finding shows that one release workflow installs outside a lockfile, so this is a minor hygiene concern.