electron-to-chromium

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-contributor concentration is not offset by visible organizational handoff capacity.

Repo bus factorcaution

One contributor made all 124 commits in the last 3 months, leaving maintenance highly dependent on a single person. The strong activity compensates for abandonment concerns only partly, so this remains a real resilience gap.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, although the package's small, dependency-free runtime surface limits its effect.

Workflow auditcaution

Both workflows were analyzed, but all five action references are unpinned and the publish workflow installs a package outside the lockfile, creating avoidable supply-chain hygiene concerns. The reported cache-poisoning issue has low confidence and is treated as hygiene rather than a severe risk.