domutils

Project backingcaution

The source repository is owned by a user account rather than an organization, so the single-maintainer and concentrated-activity concerns are not compensated by organizational backing.

Repo bus factorcaution

All recent commits came from one contributor with a 100% share; the repository is user-owned rather than organization-owned, so no project-backing evidence offsets this concentration.

Repo commit activitycaution

Only 1 commit from 1 active maintainer was recorded in the last 3 months, indicating thin recent development activity despite the recent registry releases.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and disclosure expectations less transparent even though security scanning is enabled.

Workflow auditcaution

All 15 action references are unpinned, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow; the low-confidence cache-poisoning finding is only a hygiene concern, with no untrusted checkout or script injection observed.