lwouis/alt-tab-macos: technical due diligence, read from its repository

In the last 24 months, 64 of 817 commits (7.8%) carry any trace of review: a merge, a pull-request reference, a Reviewed-by or Reviewed-on trailer, a Closes/Fixes reference, a maintainer's sign-off on someone else's change, or a change applied by someone other than its author. That is low but not absent. Review may happen in a workflow this history does not record; a buyer should ask how change is approved before it ships.

The lockfile last changed 394 days before the newest commit, and 537 commits have landed since. Every security fix published upstream in that time is absent until someone updates it, and the longer the gap the larger and riskier that update becomes.

There is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.

6 of 34 locked dependencies match 8 published advisories in OSV, 2 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.

package.json declares MIT. LICENCE.md contains the text of GPL-3.0. Package managers and downstream users read the first; auditors and acquirers read the second. One of them is wrong, and until it is settled the terms this code is offered under are genuinely ambiguous.