npm-install-checks

Repo commit activitycaution

Only one commit was recorded in the last three months and it came from one active maintainer, so current maintenance throughput is light despite the recent release.

Token permissionscaution

All workflows declare permissions, while four use top-level write permissions for release or automation workflows. This is a contained workflow-hygiene caution rather than a severe concern because the workflows were otherwise clean.