spiral/stempler-bridge

Name lookalikedanger

The package is reported to borrow the identity of spiral/nyholm-bridge, which has far more downloads, and it is not described as a fork. Although artifact overlap is low, the identity borrowing is strong supply-chain evidence that consumers may have wanted the lookalike instead.

Repo bus factorcaution

One contributor made all 7 commits in the last 3 months, giving the repository a 100% top-contributor share. The organization backing reduces handoff risk somewhat, but current activity remains concentrated.

Repo commit activitycaution

The repository recorded 7 commits in the last 3 months, showing recent activity. However, all activity came from one active maintainer, limiting resilience.

Security policycaution

The repository has no published security policy. This is a transparency gap for reporting and handling vulnerabilities, though it is not evidence of abandonment by itself.

Workflow auditcaution

Both workflows were analyzed cleanly with no dangerous triggers, untrusted checkouts, script injections, or audit findings. However, both of the two action references are unpinned, leaving their build inputs less reproducible.