unzipper

Repo bus factorcaution

Two contributors were active, but one supplied about 89% of recent commits. Because the repository is user-owned rather than organization-owned, this concentration leaves a meaningful continuity risk.

Repo toolingcaution

The project uses build tooling, but no security scanning tools were detected. This is a transparency and maintenance-process gap rather than evidence of unsafe code.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All 11 action references are unpinned, one workflow grants top-level write permissions, and the publish workflow installs a package outside a lockfile. The audit found no untrusted checkout or script-injection path, which limits the severity.