proc-log

Repo bus factorcaution

One contributor made 100% of the single recent commit. Because the repository is owned by an organization and the package has multiple registry maintainers, this concentration is a caution about observed activity rather than a severe continuity risk.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, indicating slow recent source activity. The recent release and organization backing partly compensate, but maintenance momentum is limited.

Workflow auditcaution

All 8 workflows were analyzed, but all 38 action references are unpinned and 4 workflows grant top-level write permissions, creating avoidable workflow-supply-chain exposure. High-confidence template-injection findings in two workflows and a medium-confidence bot-condition finding add hygiene concerns, although no untrusted checkout or script-injection sink was found.