@antfu/install-pkg

Package scaffoldingcaution

The artifact and repository include a README, while tests and a changelog are absent from both. The GitHub Releases setup provides some release transparency, but the missing tests leave less evidence of regression coverage.

Repo bus factorcaution

All 5 recent commits came from one contributor, creating a real single-person continuity risk. The organization-owned repository provides some ability to hand maintenance off, so this is caution rather than a severe abandonment signal.

Repo toolingcaution

The repository uses TypeScript, Vite, and npm scripts for builds, but no security scanning tools were detected. Standard build tooling supports maintainability, while the missing scanning is a modest transparency gap.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented. This lowers transparency but is not by itself evidence that the package is unsafe to depend on.

Token permissionscaution

One workflow lacks top-level token permissions, while the other declares read-only permissions and neither declares top-level write access. The incomplete restriction is a minor workflow-hygiene gap, not a severe risk.