eslint-plugin-yml

Repo bus factorcaution

The top contributor made about 71% of the 7 recent commits, but two additional contributors were active, making this concentration a modest concern rather than a severe single-person dependency.

Repo toolingcaution

The project uses TypeScript, npm scripts, and Vite, but no security scanning tools were detected, leaving a modest repository-hygiene gap.

Security policycaution

No repository security policy was found, reducing transparency about how maintainers handle vulnerability reports.

Type declarationscaution

The indicator reports no type declarations, which is a consumer-facing gap for an ESLint plugin configuration API, although the published file tree includes a declaration-looking lib/index.d.mts file.

Workflow auditcaution

All 25 analyzed action references are unpinned, and the audit found a high-severity but low-confidence cache-poisoning pattern plus a high-confidence adhoc package install. No untrusted checkout or script injection was detected, which limits the risk.