unplugin-utils

Repo bus factorcaution

All four recent commits came from one contributor, with a 100% top-contributor share. Because the repository owner is an individual rather than an organization, this creates a real continuity risk.

Security policycaution

The repository has no security policy. This does not show a security defect, but it reduces transparency about vulnerability reporting and handling.

Workflow auditcaution

All three workflows were analyzed cleanly with no injection or untrusted-checkout findings and mostly scoped permissions. However, all four action references are unpinned, leaving build inputs less reproducible and increasing dependence on mutable upstream actions.