init-package-json

Repo bus factorcaution

All recent commits came from one contributor, creating a concentrated short-term bus factor. Organization ownership partly compensates because maintenance can be handed off, but current activity remains narrow.

Repo commit activitycaution

Only one commit was recorded in the last three months, indicating thin recent activity despite the recent push and release history. This lowers confidence in ongoing maintenance.

Workflow auditcaution

All eight workflows were analyzed, but all 38 action references are unpinned and four workflows grant top-level write permissions. High-confidence template-injection findings and a medium-confidence bot-condition finding add workflow hygiene concerns, though no untrusted checkout or script-injection path was reported.