engine.io-client

Repo bus factorcaution

One contributor made 100% of the 27 recent commits. Organization ownership provides some handoff capacity, but no second contributor was active in this period.

Repo commit activitycaution

The repository recorded 27 commits in the last 3 months, but all were made by one active maintainer, so maintenance capacity is narrower than the activity count suggests.

Repo package mentioncaution

The linked repository is an organization monorepo and does not match the package name or mention it in the README, creating some uncertainty that it is the precise package source; the monorepo context partly explains the mismatch.

Repo toolingcaution

The project uses established build tooling including Rollup, TypeScript, and Babel, but no security scanning tools were detected, leaving a modest hygiene gap.

Workflow auditcaution

All 14 workflows were analyzed with no untrusted checkout or script-injection paths, and permissions are read-only or job-scoped. However, all 28 action references are unpinned; the low-confidence cache-poisoning finding is hygiene rather than a standalone severe risk.