martinez-polygon-clipping

Maintainerscaution

Only one registry account, w8r, has publish access. The repository is user-owned rather than organization-backed, so there is limited visible publishing and succession depth.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Recent releases and merged pull requests partly compensate, but the absence of direct commit activity raises maintenance risk.

Repo toolingcaution

The repository uses TypeScript, Vite, Vitest, and npm build tooling, and it has repository tests. No security scanning tools are present, leaving a modest security-process gap.

Security policycaution

The repository has no security policy. This reduces transparency for reporting and handling vulnerabilities, though it does not by itself show that the code is unsafe.

Workflow auditcaution

Both workflows were analyzed without untrusted triggers or script injection, and one scopes permissions at job level. However, all four action references are unpinned and the publish workflow installs a package outside the lockfile; the low-confidence cache finding carries little weight.