make-event-props

Release historycaution

The package has 14 releases over roughly eight years but none in the last 12 months. The linked repository remains active, which partly offsets the quiet registry cadence.

Repo bus factorcaution

All six recent commits came from one contributor, leaving maintenance dependent on a single individual and increasing abandonment risk.

Repo toolingcaution

The project uses TypeScript, Vitest, Vite, and npm scripts for builds and tests, but no security scanning tooling was detected.

Security policycaution

The repository has no security policy, leaving reporting and response expectations undocumented for users and contributors.

Workflow auditcaution

All 13 action references are unpinned, one workflow grants top-level write access, and the audit found high-severity cache-poisoning with low confidence plus high-confidence ad hoc package installs. No untrusted checkout or script-injection path was detected, limiting the impact.