validate-npm-package-name

Repo bus factorcaution

All recent commits come from one contributor, concentrating short-term activity; the organization-owned repository provides some ability to hand maintenance off.

Repo commit activitycaution

Only one commit from one active maintainer was observed in the last 3 months, which is a genuine maintenance-capacity concern despite the recent release history.

Workflow auditcaution

All 8 workflows were analyzed, but all 38 action references are unpinned and 4 workflows grant top-level write permissions. High-confidence template-injection findings and a medium-confidence bot-condition finding add workflow hygiene concerns, though no untrusted checkout or script-injection sink was found.