js-md5

Repo bus factorcaution

All five recent commits came from one contributor, so maintenance continuity depends heavily on that individual.

Repo toolingcaution

The project uses Rollup and npm scripts for builds, but no security scanning tools were detected, leaving a modest visibility gap.

Security policycaution

The repository has no security policy, which weakens the documented process for reporting and handling vulnerabilities.

Workflow auditcaution

Both workflows were analyzed without high-confidence audit findings or untrusted-code sinks, but all five action references are unpinned and one workflow grants top-level write permissions; this is a workflow hygiene concern, not a severe risk by itself.