johnbacon/stout

Project backingcaution

The registry namespace and repository are owned by the same individual, so the package has clear ownership but no demonstrated organizational backing to reduce single-owner risk.

Release historycaution

The package has 45 releases but none in the last 12 months, and the latest registry release is over two years old. Recent repository activity partly offsets the concern, but the published release is stale.

Repo bus factorcaution

Eight contributors were active recently, but one contributor made about 82% of commits. That concentration leaves meaningful handoff risk despite the broader contributor set.

Workflow auditcaution

All six workflows were analyzed and action references are pinned, with no untrusted checkout or script-injection findings. However, four workflows grant top-level write permissions and the audit reports a high-confidence template-injection issue, so CI hygiene needs attention.