scorm-again

Maintainerscaution

Only one registry account, jcputney, has publish access. This is a resilience concern, although repository activity shows the package is actively maintained.

Project backingcaution

The repository is owned by a user account rather than an organization, so the concentrated maintainer and publishing model has no demonstrated organizational handoff to offset it.

Repo bus factorcaution

Three contributors were active, but jcputney made 102 of 106 commits, or about 96%, leaving maintenance heavily concentrated in one person.

Workflow auditcaution

All seven workflows were analyzed with no untrusted checkouts or script-injection counts, but 59 of 62 action references are unpinned and five workflows have top-level write permissions. High-confidence bot-conditions and template-injection findings are workflow hygiene concerns; the cache-poisoning findings are low confidence and do not show an untrusted trigger-sink combination.