js-sha256

Repo bus factorcaution

Three contributors were active recently, but the leading contributor made 9 of 11 commits, leaving maintenance substantially concentrated in one person.

Repo toolingcaution

Rollup and npm build tooling are present, but no security scanning tools were detected; this is a modest repository hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and response expectations less transparent.

Workflow auditcaution

Both workflows were fully analyzed with no auditor findings or untrusted checkout and script-injection paths. However, all 9 action references are unpinned and the publish workflow has top-level write permissions, creating moderate build-hygiene concerns.