koa-bodyparser

Release historycaution

The package has 30 releases over a long history, but its latest registry release was over three years ago and there were no releases in the last 12 months.

Repo bus factorcaution

All recent repository commits came from one contributor, creating concentration risk, although the repository is owned by an organization that can provide some handoff capacity.

Repo commit activitycaution

Only one commit from one active maintainer was recorded in the last three months, showing limited recent maintenance capacity.

Repo toolingcaution

The repository uses TypeScript and tsup for builds, but no security-scanning tool was detected; this is a modest transparency gap rather than a severe concern.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, injection findings, or high-severity issues. Both action references are unpinned, which weakens build reproducibility but is not a severe workflow risk here.