zod

Maintainerscaution

Only one registry account has publish access, which creates publishing continuity risk. The active repository and high recent commit activity provide meaningful compensation, but not a second registry publisher.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated maintainer activity and single registry publisher represent a meaningful continuity risk.

Repo bus factorcaution

The leading contributor made 83.2% of recent commits, creating concentration risk. However, 14 other contributors were active during the same three-month period, which partly offsets but does not eliminate the dependency on one maintainer.

Repo toolingcaution

The repository uses established TypeScript, test, bundling, and build tooling. It has no security-scanning tools, leaving a genuine security-process gap despite otherwise mature development tooling.

Token permissionscaution

Four workflows lack top-level permissions and three declare top-level write access, which is weaker workflow hardening than ideal. The analysis still found no dangerous workflow patterns, partially limiting the concern.