a35g/json-to-xml

Release historycaution

The package is only 12 days old with four releases and a median interval of about 5 days, so long-term maintenance is not yet demonstrated.

Repo bus factorcaution

All six recent commits came from one contributor, so maintenance depends heavily on a single person and has limited handoff resilience.

Workflow auditcaution

Both workflows were analyzed successfully with no untrusted checkout or script-injection paths, but all seven action references are unpinned and the audit reported a low-confidence cache-poisoning pattern.