execa

Project backingcaution

The repository is owned by a user account rather than an organization, so the concentrated recent contributor activity is not offset by explicit organization backing. The active project history still provides meaningful support.

Repo bus factorcaution

One contributor made all 35 commits in the last three months, giving the project a concentrated recent maintenance base. The long project history and active repository reduce but do not remove this continuity risk.

Repo toolingcaution

The repository uses TypeScript, Gulp, and npm scripts, demonstrating a real build process. No security-scanning tools were detected, which is a modest transparency gap but not decisive given the other evidence.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, injection findings, or audit findings, and it has no broad top-level write permission. All five action references are unpinned, however, leaving build inputs less reproducible.