node-cron

Repo bus factorcaution

One contributor made about 95% of the last three months' commits, creating concentration risk. The organization-owned repository and four additional active contributors partly compensate, so this is a caution rather than a severe risk.

Repo toolingcaution

The project uses TypeScript, Rollup, Vitest, and related build tooling, but no security-scanning tools were detected. This is a modest transparency and hygiene gap, not evidence of abandonment.

Workflow auditcaution

The audit found a high-confidence template-injection issue in the release workflow, low-confidence-free because the finding is high confidence, plus an adhoc package install and all 15 action references unpinned. No untrusted checkouts or script injections were found, so these are workflow hygiene and release-integrity cautions rather than standalone critical risks.