read-package-json-fast

Repo bus factorcaution

All recent commits came from one contributor, creating concentration risk; npm organization ownership provides some maintenance capacity but no second active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, indicating limited recent development activity despite the recent release.

Workflow auditcaution

All eight workflows were analyzed, but all 38 action references are unpinned. The audit also found three high-confidence template-injection findings and four workflows with top-level write permissions; because no untrusted checkout or injection trigger was reported, these are workflow-hygiene concerns rather than standalone severe risk.