eslint-plugin-html

A single person made all 7 recent commits, so maintenance depends heavily on one contributor. The package is well documented, typed, licensed, actively released, and its workflow has no untrusted-code or write-token exposure, though unpinned actions and an ad hoc package install weaken build hygiene.

Latest 8.2.1

NPM

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Health Score Breakdown

Project backing

The repository owner is an individual user rather than an organization, so the concentrated commit activity has no organizational handoff evidence to offset the bus-factor concern.

Repo bus factor

One contributor made 100% of the 3-month commits, creating a clear single-maintainer continuity risk. The risk is softened by the repository's recent activity and long release history, but not removed.

Repo commit activity

The repository recorded 7 commits in the last 3 months, showing recent work. However, all activity came from one active maintainer, so the maintenance base is narrow.

Security policy

The repository has no security policy. This is a transparency and vulnerability-reporting gap, though it is partly offset by Dependabot and the project's modest runtime dependency surface.

Workflow audit

All workflows were analyzed with no untrusted checkout, script injection, or top-level write permissions. However, all 6 action uses are unpinned and the audit found a high-confidence low-severity ad hoc package install, leaving build-reproducibility and workflow-hygiene concerns.