@ctrl/tinycolor

Lifecycle scriptscaution

A prepare lifecycle script is present, which adds some install-time execution surface; however, the package has zero runtime dependencies and the linked repository shows structured TypeScript/npm build tooling.

Maintainerscaution

Only one registry account has publish access, creating a limited publishing bus factor; this is partly offset by the directly backed repository and recent release activity, but the registry-side concentration remains a caution.

Project backingcaution

The repository is owned by a user rather than an organization, so there is no organizational maintenance cushion; however, the package is directly associated with that repository and has recent release and collaboration activity.

Repo commit activitycaution

No commits and no active maintainers were recorded in the last three months. This conflicts with the very recent release and pull-request activity, so it is a meaningful indicator of potentially episodic maintenance rather than a severe abandonment verdict.

Repo toolingcaution

The repository uses TypeScript, npm scripts, and Rollup for builds, but no security scanning tools were detected. The build setup is healthy, while the missing security tooling is a modest transparency gap.