magic-string-ast

Maintainerscaution

Only one registry account has publish access. This is a modest publishing continuity concern, although repository activity and provenance show the same maintainer is actively releasing the package.

Repo bus factorcaution

All eight recent commits came from one contributor, so maintenance depends heavily on a single person and could be disrupted if they stop contributing.

Security policycaution

No repository security policy is present. This is a transparency gap, but it is partly offset by the repository's security scanning and otherwise active maintenance.

Workflow auditcaution

All three workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, injections, or audit findings; however, all four referenced actions are unpinned, leaving them exposed to upstream changes.