ssri

Repo bus factorcaution

All recent commits came from one contributor. The npm organization provides backing, but no second active contributor is shown in this period.

Repo commit activitycaution

Only one commit was recorded in the last 3 months, so current development activity is thin despite the recent release history.

Workflow auditcaution

All 38 action references are unpinned, and four workflows grant top-level write permissions; high-confidence template-injection findings and a medium-confidence bot-condition finding add workflow hygiene concerns, though no untrusted checkout or script-injection trigger was found.