eventsource-parser

Dangerous workflowscaution

Two workflows use pull_request_target and one performs an untrusted checkout, creating avoidable risks in automation handling untrusted changes even though no script injection was detected.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the concentrated recent commit activity represents a genuine single-owner continuity risk.

Repo bus factorcaution

The top contributor made about 73% of the recent commits, creating some concentration risk, although three other contributors were active during the same period.

Repo toolingcaution

The project uses TypeScript, npm scripts, and esbuild, but no security-scanning tools were detected. This is a modest security-process gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.