vite-plugin-dts

Project backingcaution

The linked repository is owned by an individual user rather than an organization, so the concentrated commit share is not offset by visible organizational handoff capacity.

Repo bus factorcaution

One contributor made 12 of 14 recent commits, or about 86%, while two others made one each. This concentration creates a meaningful continuity risk for a user-owned project.

Repo toolingcaution

The repository uses established build tools, but no security scanning tools were detected. That is a workflow hygiene gap, though the active build setup provides some compensating maturity evidence.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

All 11 analyzed action references are unpinned, and one workflow grants top-level write permissions, creating avoidable supply-chain and permission exposure. The high-confidence template-injection finding is hygiene risk; the low-confidence cache-poisoning findings carry limited weight because no untrusted checkout or script injection was found.