mime

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer represents a genuinely narrow publishing base.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months, which is a maintenance concern, although four pull requests were merged in the last month and a new release was published.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected; this is a modest transparency gap rather than evidence of abandonment.

Security policycaution

No repository security policy was found, reducing the project's published guidance for vulnerability reporting.

Workflow auditcaution

Both workflows were analyzed with no untrusted checkouts or script injection, but all five action references are unpinned and one workflow has top-level write permissions. The low-confidence cache-poisoning finding is hygiene evidence only.