socket.io-adapter

Repo bus factorcaution

All 32 recent commits came from one contributor, giving the release a concentrated maintenance base. Organizational ownership provides some handoff capacity, but no second active contributor is shown.

Repo package mentioncaution

The repository name does not match socket.io-adapter and its README does not mention the package, creating uncertainty about package-to-source alignment even though a monorepo can legitimately contain subpackages.

Workflow auditcaution

All 28 analyzed action references are unpinned, which weakens build reproducibility; the reported low-confidence cache-poisoning finding is only a hygiene concern and does not independently establish a severe risk.