why-is-node-running

Project backingcaution

The repository is owned by an individual rather than an organization, so the two-person registry maintainer base provides only limited visible continuity. Other signals show the project is still published and maintained.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last 3 months. Recent release and pull-request activity partly offsets this, but the lack of direct commit activity is a maintenance concern.

Repo toolingcaution

No build tool or security scanning tool was detected. For this small package the lack of a build system is unsurprising, but absent security scanning is a modest transparency gap.

Security policycaution

The repository has no security policy. This does not make the package unsafe, but it leaves vulnerability-reporting expectations undocumented.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings, no untrusted checkout, and job-level permissions. However, both of its two action references are unpinned, leaving their resolved code less reproducible.