@isaacs/cliui

Lifecycle scriptscaution

The package uses a prepare install-time lifecycle script. This is a modest supply-chain and installation-complexity concern, although the repository shows an established TypeScript/build-tool workflow.

Release historycaution

The package has only 2 releases across about 3 years 5 months, with 1 release in the last 12 months and a median interval of about 2 years 9 months. This indicates a slow maintenance cadence, though the latest release is recent.

Repo commit activitycaution

There were 0 commits and 0 active maintainers in the last 3 months. This is a meaningful sign of currently quiet maintenance, partly offset by the recent release and repository push.

Repo toolingcaution

The repository uses TypeScript, npm scripts, and esbuild, showing a defined build process, but no security-scanning tools were detected. The missing scanning is a minor transparency and hygiene gap.

Workflow auditcaution

Both workflows were analyzed with no audit findings, and one workflow uses read-only permissions. However, all 7 action references are unpinned and one workflow has top-level write permissions; the pull_request_target trigger has no reported untrusted checkout or injection sink.