@isaacs/ttlcache

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is present, leaving the relationship between the source and published artifact less independently verifiable.

Lifecycle scriptscaution

The package uses a prepare install-time lifecycle script, which adds build-time behavior during installation and warrants review, though this signal alone does not indicate an unsafe release.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, a maintenance concern; however, the latest release was published during that period, so this is not evidence of abandonment by itself.

Repo toolingcaution

The repository uses TypeScript build tooling, but no security scanning tools were detected, leaving automated security oversight less visible.

Token permissionscaution

All workflows declare top-level permissions, although one workflow requests write access; explicit permissions improve transparency, while write access is broader than read-only operation.