js-queue

Repo bus factorcaution

One contributor made 75% of the recent commits, but a second contributor made the remaining 25%, so concentration is a moderate resilience concern rather than a severe single-person dependency.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap, not evidence that the release is unsafe.

Workflow auditcaution

All 22 action references are pinned and the audit completed, but one workflow-run workflow checks out untrusted content and two workflows grant top-level write access. A high-confidence low-severity finding also reports a package installed outside a lockfile, so CI hygiene merits attention without making the release unfit.