multitars

Repo bus factorcaution

All 15 recent commits came from one contributor, creating concentration risk. Organization ownership partly compensates because maintenance can be handed off internally, but no second active contributor is shown.

Repo toolingcaution

The project uses TypeScript, Rollup, npm scripts, and Babel, showing an established build process, but no security scanning tool is reported.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear for a package that processes archive and multipart data.

Version stabilitycaution

Version 1.0.2 is a stable major release and is not a prerelease, although the recent prerelease share of 80% indicates an experimental development stream around it.

Workflow auditcaution

Both workflows were analyzed successfully and avoid untrusted triggers and script-injection sinks, but all 10 action references are unpinned and the release workflow installs a package outside a lockfile. These are build-reproducibility and hygiene concerns rather than a severe risk.