ghost

Dependency profilecaution

The package declares 171 runtime dependencies, creating a broad maintenance and transitive-update surface compared with a small library. Its application-sized package structure partly explains this profile but does not remove the added complexity.

Maintainerscaution

Publishing access is concentrated around the ghost.org domain and the repository is organization-backed, which supports continuity. Several consumer Gmail accounts and outside-domain accounts remain account-hygiene concerns: erisds, minimaluminium, bobvaneck, sagzy, vershwal, mike182uk, renatoworks, weylandswart, tmciesco, 9larsons, allouis, johnonolan, jloh, sam-lord, joeegrigg, and jonhickman.

Workflow auditcaution

All 25 workflows were analyzed and all 160 action references are pinned, with no untrusted checkout or script-injection findings. High-confidence findings include broad GitHub App permissions, template-injection patterns, and ad hoc package installs; low-confidence cache findings are hygiene concerns, while broad workflow write permissions add mild caution.