npm-pick-manifest

Repo bus factorcaution

All recent commits came from one contributor. Because the repository is owned by an organization, maintenance can be handed off, which partly offsets the concentration but does not remove the recent-activity concern.

Repo commit activitycaution

Only one commit was recorded in the last three months, from one active maintainer. This is sparse for a maintained package, though the recent release history shows the project has not been abandoned.

Workflow auditcaution

All eight workflows were analyzed, but all 38 action references are unpinned, and four workflows grant top-level write permissions. High-confidence template-injection findings and a medium-confidence bot-condition finding are present; without untrusted checkout or injection triggers, these remain workflow-hygiene concerns rather than standalone severe risks.