npm-audit-report

Repo bus factorcaution

All 3-month commit activity came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is shown in this period.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, indicating limited recent development activity and leaving maintenance capacity less demonstrated than the release history alone suggests.

Workflow auditcaution

All 8 workflows were analyzed, with no untrusted checkouts or script-injection findings, but all 38 action references are unpinned and 4 workflows grant top-level write permissions. High-confidence template-injection findings and a medium-confidence bot-condition finding add workflow hygiene concerns, although no dangerous trigger or sink is shown.