npm-normalize-package-bin

Repo bus factorcaution

All recent commits came from one contributor, creating a concentrated maintenance path. The npm-owned organization provides some capacity to hand maintenance off, but no second recent contributor is shown.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, which indicates limited recent activity, although the package also has a recent release and organizational backing.

Workflow auditcaution

All 8 workflows were analyzed, with no untrusted checkout or script-injection trigger findings, but all 38 action references are unpinned and 4 workflows grant top-level write permissions. High-confidence template-injection findings and a medium-confidence bot-condition finding also require workflow maintenance, though no dangerous trigger-and-sink combination is shown.