websocket-driver

Maintainerscaution

Only one registry account has publish access, leaving publishing capacity dependent on a single person; organization backing provides some compensation but does not remove the concentration risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the past three months, which weakens evidence of ongoing maintenance despite the recent package release and push.

Repo toolingcaution

The repository reports no build tooling or security scanning. This is a hygiene gap, though the project still has tests and a straightforward small source tree.

Workflow auditcaution

All two action references are unpinned, and the high-confidence audit found an adhoc package installation outside a lockfile. The audit is complete and found no untrusted checkout or script-injection path, limiting the impact.