pacote

Repo bus factorcaution

All recent repository commits came from one contributor, creating concentration risk; the organization's ownership provides some capacity to hand maintenance off but does not remove the recent inactivity concern.

Repo commit activitycaution

Only one commit was recorded in the last three months, indicating weak recent source activity despite the package's strong longer-term release history.

Workflow auditcaution

The audit covered all eight workflows, but found high-confidence template-injection findings and all 38 action references are unpinned; four workflows also grant top-level write permissions. No untrusted checkout, script-injection, pull_request_target, or workflow_run path was found, so these are serious hygiene concerns rather than a standalone severe dependency risk.