spdx-expression-parse

Repo bus factorcaution

All recent commits came from one contributor, creating a narrow current maintenance base; organization backing partly offsets the handoff risk.

Repo commit activitycaution

Two commits in the last three months show some continuing activity, though the volume is modest for an established project.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear, although this is a transparency gap rather than evidence of unsafe code.

Type declarationscaution

No type declarations are included, which is a real integration gap for TypeScript consumers of this JavaScript library.

Workflow auditcaution

The sole workflow was fully analyzed with no injection or high-confidence audit findings, but both referenced actions are unpinned, weakening build reproducibility.