pixelmatch

Repo bus factorcaution

One contributor made 100% of the four commits in the last three months, leaving recent maintenance dependent on a single person despite organization ownership.

Repo commit activitycaution

Four commits were made in the last three months, so activity has not stopped, although all were made by one active maintainer.

Repo toolingcaution

The project uses TypeScript build tooling, but no security scanning tools were detected; this is a modest transparency gap rather than a severe dependency-health concern.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both action references are unpinned, which weakens build reproducibility and action supply-chain hygiene.