sql.js

Repo bus factorcaution

All 10 recent commits came from one contributor, creating a meaningful continuity risk despite organization ownership.

Repo toolingcaution

The project uses established build tooling, but no security-scanning tools were detected in the repository.

Security policycaution

No repository security policy was detected, reducing transparency about how vulnerability reports are handled.

Type declarationscaution

No type declarations are included, which is a consumer-ergonomics gap for TypeScript users, but the package is clearly documented as a JavaScript/WebAssembly library.

Workflow auditcaution

All 10 analyzed action references are pinned and the audit found no untrusted checkout or script-injection path. One release workflow installs a package outside a lockfile with high confidence; the low-confidence cache-poisoning finding is hygiene rather than a decisive risk.