modern-ahocorasick

Maintainerscaution

Only one registry account has publish access, which creates a thin publishing base. The repository is owned by an organization, providing some backing that makes this less concerning than a wholly unaffiliated single-maintainer project.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, which is a meaningful maintenance warning. Recent release activity and 9 merged pull requests in the last month partly compensate, but do not remove the concern.

Repo toolingcaution

The repository uses TypeScript, Vitest, Turbo, and npm scripts, showing established build and test tooling. No security scanning tools were detected, leaving a modest hygiene gap.

Security policycaution

No repository security policy was found. This reduces transparency for reporting vulnerabilities, although it is a process gap rather than evidence of abandonment by itself.

Workflow auditcaution

Both workflows were analyzed successfully, all 13 action references are pinned, and no untrusted checkout or script-injection paths were found. One release workflow has top-level write permissions and a high-confidence low-severity adhoc package installation, so workflow hygiene is not perfect but is not a severe dependency risk.