@cypress/request

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported. That limits transparency about how the published artifact was produced.

Dangerous workflowscaution

One of three workflows uses pull_request_target, which can require careful privilege handling. No untrusted checkout or script-injection patterns were detected, so the workflow profile is a limited caution rather than a severe risk.

Dependency profilecaution

The package has 17 runtime dependencies, including networking, authentication, streaming, and multipart components. This is a meaningful dependency surface to maintain, though the release notes show at least one dependency was recently updated for a reported vulnerability.

Maintainerscaution

Only one registry publishing account is listed, which creates a narrow publishing path. The organization-owned repository provides some compensating backing, so this is a caution rather than a severe risk.

Repo commit activitycaution

The repository had 0 commits and 0 active maintainers in the last three months. Despite a recent push and release, this is direct evidence of currently low development activity and raises abandonment risk.