npm-bundled

Repo bus factorcaution

All recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second recent contributor is shown, leaving a concentrated maintenance base.

Repo commit activitycaution

Only one commit from one active maintainer was recorded in the last three months, indicating thin recent development activity despite the recent release.

Type declarationscaution

No type declarations are published. This is a minor integration gap for consumers using the JavaScript library, but it does not indicate abandonment or unsafe maintenance.

Workflow auditcaution

All eight workflows were analyzed, but all 38 action references are unpinned, four workflows grant top-level write permissions, and high-confidence template-injection findings were reported. No untrusted checkout or script-injection trigger was found, so these are workflow hygiene concerns rather than a severe release risk.