isolated-vm

Maintainerscaution

Only one account has registry publish access, creating some publishing continuity risk. However, repository activity shows three active contributors, partly compensating for the narrow registry maintainer list.

Project backingcaution

The repository is owned by a user account rather than an organization, so the single registry maintainer and small contributor base are not supported by visible organizational backing.

Repo toolingcaution

The repository uses build tooling, but no security scanning tools were detected. For a native package this is a meaningful security-hygiene gap, though it does not by itself indicate abandonment or maliciousness.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency for a library that executes native code, although the active repository and other provenance signals provide some compensation.

Token permissionscaution

Neither workflow declares top-level token permissions, and no workflow is explicitly read-only. Although no write permissions were detected, the lack of least-privilege declarations is a workflow hygiene concern.