npm-package-arg

Repo bus factorcaution

All recent commits came from one contributor, which concentrates short-term maintenance activity; the organization-owned repository provides some capacity to hand work off, but no second recent contributor is shown.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, indicating limited recent development activity even though the release history shows continued publishing.

Workflow auditcaution

All 8 workflows were analyzed, but all 38 action references are unpinned and four workflows grant top-level write permissions. High-confidence template-injection findings and a medium-confidence bot-condition finding add release-process hygiene concerns, although no untrusted checkout or script-injection path was found.