entities

Dangerous workflowscaution

One of five workflows uses pull_request_target, which can increase CI privilege risk, but there are no untrusted checkouts or script-injection findings.

Maintainerscaution

Only one registry account has publish access, which is a modest publishing bus-factor concern; however, repository activity shows three active maintainers and npm provenance provides additional release transparency.

Project backingcaution

The repository is owned by the named individual fb55 rather than an organization; this is consistent with the single registry maintainer and makes the observed contributor concentration more relevant.

Repo bus factorcaution

Three contributors were active, but the top contributor made about 78% of recent commits, leaving meaningful concentration risk despite the presence of two additional contributors.

Token permissionscaution

Three workflows declare read-only permissions, but the publish workflow lacks top-level permissions and the Dependabot auto-merge workflow declares write permissions; this is a workflow-hygiene concern rather than evidence of unsafe package behavior.