mpd-parser

Repo toolingcaution

Rollup, npm scripts, and Babel provide an established build process, but no security-scanning tooling was detected, leaving a modest transparency gap.

Security policycaution

No repository security policy was found, which weakens vulnerability-reporting transparency, though the active organization-backed project and recent release provide some compensation.

Workflow auditcaution

All eight analyzed action references are unpinned, which weakens workflow reproducibility. The cache-poisoning finding is low confidence and therefore hygiene at most; there are no untrusted checkouts, script injections, or broad top-level write permissions.