node-llama-cpp

Run AI models locally on your machine with node.js bindings for llama.cpp. Enforce a JSON schema on the model output on the generation level

Latest 3.22.1

NPM

78%

Total Score

healthy

Healthy: frequent releases and current repository activity outweigh concentrated maintenance and workflow-hygiene concerns.

Health Score Breakdown

Lifecycle scripts

The package runs postinstall and prepare scripts, which can perform installation-time work and increase dependency-install complexity, although this is consistent with a package that supplies native bindings.

Repo bus factor

One contributor made all 15 commits in the last 3 months, creating a concentrated maintenance risk; organization backing provides some capacity for handoff but does not demonstrate a second active contributor.

Repo tooling

The repository uses TypeScript, Vitest, CMake, Vite, and npm scripts, but no security-scanning tools were detected, leaving a modest transparency gap.

Security policy

No SECURITY.md or other security policy was detected, making vulnerability-reporting expectations unclear.

Workflow audit

All three workflows were analyzed without failed files, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all 51 action references are unpinned, and the high-confidence low-severity adhoc-packages finding indicates a workflow installs outside a lockfile.