eslint-plugin-html

Project backingcaution

The repository owner is an individual user rather than an organization, so the concentrated commit activity has no organizational handoff evidence to offset the bus-factor concern.

Repo bus factorcaution

One contributor made 100% of the 3-month commits, creating a clear single-maintainer continuity risk. The risk is softened by the repository's recent activity and long release history, but not removed.

Repo commit activitycaution

The repository recorded 7 commits in the last 3 months, showing recent work. However, all activity came from one active maintainer, so the maintenance base is narrow.

Security policycaution

The repository has no security policy. This is a transparency and vulnerability-reporting gap, though it is partly offset by Dependabot and the project's modest runtime dependency surface.

Workflow auditcaution

All workflows were analyzed with no untrusted checkout, script injection, or top-level write permissions. However, all 6 action uses are unpinned and the audit found a high-confidence low-severity ad hoc package install, leaving build-reproducibility and workflow-hygiene concerns.