electron-to-chromium

Maintainerscaution

Only one registry account has publish access, which leaves publishing dependent on a single person; repository activity confirms that person is currently active but does not remove the concentration risk.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated contributor and publisher base has no visible organizational handoff to offset it.

Repo bus factorcaution

One contributor made all 124 commits in the last 3 months, creating a meaningful continuity risk despite the high activity level and recent releases.

Security policycaution

No security policy is present, reducing transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

Both workflows were analyzed successfully, but all 5 action references are unpinned, the publish workflow installs a package outside a lockfile, and one workflow has top-level write permissions. The low-confidence cache-poisoning finding is hygiene only, but the high-confidence adhoc-packages finding warrants caution.