alexminza/wc-alcohol

Project backingcaution

The registry package and repository are owned by the same individual user, confirming the repository is directly associated with the package. It also means the project has no indicated organizational backing to offset its concentrated maintenance.

Repo bus factorcaution

All recent commits came from one contributor, giving the project a single-person maintenance dependency. The repository is user-owned rather than organization-backed, so there is no provided compensating handoff signal.

Repo commit activitycaution

Only one commit was recorded in the last three months, from one active maintainer. Recent activity exists, but the low volume provides limited evidence of sustained maintenance capacity.

Security policycaution

No repository security policy was found. This is a transparency gap for reporting vulnerabilities, though it is not by itself evidence of unsafe code.

Workflow auditcaution

The single workflow was fully analyzed with no detected injection or high-confidence audit findings, but both of its two action references are unpinned. The workflow also lacks a top-level permissions block, which is acceptable on its own.