@humanwhocodes/momoa

Lifecycle scriptscaution

A prepare install lifecycle script is present, which adds execution during installation, but the signal provides no evidence that it is dangerous and the repository shows ordinary build and release automation.

Repo toolingcaution

No build tool or security scanning tool was detected in the repository, leaving a security and engineering-hygiene gap despite other evidence of structured CI and release workflows.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations.

Token permissionscaution

One workflow lacks top-level permissions and two workflows declare top-level write access, creating permissions-hygiene concerns; these are mitigated by the absence of detected dangerous workflow patterns.