find-yarn-workspace-root2

Build provenancecaution

The release has no build attestation and does not use staged publishing. This is a transparency gap, although the package has a clear license and active source repository to provide some context.

Maintainerscaution

Only one account has registry publish access, matching the single active repository contributor. This is not evidence of inactivity, but it leaves release continuity dependent on one person.

Project backingcaution

The repository owner is an individual user rather than an organization. Combined with one active contributor, this provides no organizational succession signal.

Repo bus factorcaution

One contributor made all 76 commits in the last 3 months, giving the project a single-person bus factor. The active commit volume helps, but there is no second active contributor to provide continuity.

Repo package mentioncaution

The repository name does not match the package name, and the README has no confirmed mention of the package. A name mismatch can be normal for a monorepo, but the absent confirmation makes the source relationship less transparent.