obug

Maintainerscaution

Only one registry account has publish access, which is a modest publishing-continuity concern, although repository activity shows that the package is currently being maintained.

Project backingcaution

The repository is owned by an individual user, so the concentrated maintainer and registry-publisher base is not compensated by explicit organizational backing.

Repo bus factorcaution

The top contributor made five of six recent commits, so activity is concentrated and creates continuity risk; the second active contributor partly offsets that risk, but the ownership is an individual user rather than an organization.

Security policycaution

No repository security policy is present, leaving vulnerability-reporting expectations and response procedures less transparent.

Token permissionscaution

Two workflows declare read-only permissions, but release.yml lacks top-level permissions; this is a workflow-hygiene gap, though no workflow has broad top-level write permissions.