@nestjs/event-emitter

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is present, leaving release origin less independently verifiable despite the otherwise coherent repository and artifact.

Lifecycle scriptscaution

A prepare install-time script adds some installation complexity and supply-chain exposure, but this is a limited caution rather than a severe risk without evidence of dangerous behavior.

Repo toolingcaution

The repository uses TypeScript, Vitest, npm scripts, and Vite for builds and tests, but no security-scanning tools were detected, leaving a modest security-hygiene gap.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and response expectations less transparent; active maintenance provides some compensation but does not remove the gap.