regexpu-core

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated recent contribution pattern is more relevant to continuity risk.

Repo bus factorcaution

One contributor made about 71% of the seven recent commits, but a second contributor supplied the remaining 29%, partially reducing concentration risk.

Repo toolingcaution

The project uses npm scripts, but no repository security-scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, so vulnerability reporting and response expectations are not documented.

Workflow auditcaution

All 7 of 7 action references are unpinned, which weakens build reproducibility. The audit also found a high-severity cache-poisoning pattern with low confidence and a high-confidence adhoc package install; no untrusted checkouts, script injection, or broad top-level write permissions were found.