spdx-license-ids

Repo commit activitycaution

The repository has no commits and no active maintainers recorded in the last three months, which is a maintenance concern. The recent registry release and repository push partly offset this because the package is a small, stable data set.

Repo toolingcaution

The repository uses npm build scripts but reports no security-scanning tools. For a small package this is a modest transparency gap rather than a severe adoption risk.

Security policycaution

The linked repository has no documented security policy. This reduces transparency for reporting issues, although the package has a narrow data-only purpose.

Token permissionscaution

Both analyzed workflows lack top-level token-permission declarations. No workflow requests top-level write access, but explicit least-privilege settings would provide stronger CI hardening.