socket.io-client

Repo bus factorcaution

All 27 recent commits came from one contributor, creating a genuine continuity risk; organization ownership provides some handoff capacity but no second active contributor is shown.

Repo package mentioncaution

The repository name does not match the package and its README does not mention socket.io-client, so the package-to-repository relationship is less explicit; the monorepo context makes a name mismatch ordinary but does not remove this gap.

Workflow auditcaution

All 14 workflows were analyzed with no untrusted checkout or script-injection paths, and most use read-only permissions. However, all 28 action references are unpinned, and a low-confidence cache-poisoning finding remains a workflow hygiene concern.