svg-parser

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated recent contribution pattern has no visible organizational handoff buffer.

Repo bus factorcaution

One contributor made 15 of 16 recent commits, creating a real concentration risk, although a second contributor remained active.

Repo toolingcaution

The repository uses npm scripts for builds but reports no security scanning tools, leaving automated security checks less evident.

Workflow auditcaution

Both workflows were fully analyzed, all 10 action references are pinned, and no untrusted checkout or script injection was found. The audit reported only a low-confidence cache-poisoning hygiene finding, while one release workflow has broad top-level write permissions without an untrusted trigger.