vite-plugin-static-copy

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-contributor concentration has no demonstrated organizational handoff capacity.

Repo bus factorcaution

All five recent commits came from one contributor, creating a meaningful continuity risk despite the repository remaining active.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

Both workflows were analyzed successfully, use all eight referenced actions in pinned form, and show no untrusted checkout or script-injection paths. A high-confidence low-severity finding shows the release workflow installs a package outside a lockfile, a minor reproducibility concern.