electron-publish

Repo bus factorcaution

One contributor made about 89% of the recent commits, creating a real concentration risk. However, five other contributors were active during the same period and the repository is organization-owned, which partly compensates for the concentration.

Repo package mentioncaution

The repository name does not match electron-publish and its README does not mention the package, so the package-to-repository relationship is less explicit. The package description identifies it as part of electron-builder, which makes a monorepo relationship plausible but does not fully remove the transparency gap.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations less transparent. This is a documentation gap, not evidence of abandonment.

Token permissionscaution

Six workflows declare read-only permissions, but one lacks top-level permissions and two declare top-level write access. The mixed permissions posture warrants caution even though the workflow risk scan found no dangerous patterns.