gitnexus

Dangerous workflowscaution

Two workflows use pull_request_target and three use workflow_run, which deserve review because they can increase CI privilege complexity. However, no analyzed workflow performs an untrusted checkout or script injection.

Dependency profilecaution

The release has 39 runtime dependencies, including native/database and language-parser components. This is a meaningful maintenance and compatibility surface for consumers, despite fitting the package's graph-analysis functionality.

Lifecycle scriptscaution

The package runs postinstall, prepack, and prepare scripts. These add installation complexity and execution risk, although the repository's substantial build tooling and active maintenance provide some context for the scripts.

Maintainerscaution

Only one account has registry publish access. The repository is user-owned rather than organization-owned, so the active repository contributors do not fully remove the risk of a single publishing account.

Project backingcaution

The repository is owned by a user rather than an organization, so there is no organization-level backing signal. Strong recent contributor and repository activity partly compensates for that limitation.