@nestjs/terminus

Lifecycle scriptscaution

The package has a prepare install-time lifecycle script. This is a small supply-chain and installation-complexity concern because the signal does not show why the hook is needed.

Repo bus factorcaution

One contributor made 30 of 31 recent commits, so continuity depends heavily on a single person. The organization-owned repository and one additional active contributor partly compensate, making this a caution rather than a severe abandonment signal.

Repo toolingcaution

The repository uses TypeScript, Vitest, npm scripts, and Vite, but no security scanning tools were detected. The missing scanning automation is a modest transparency and hygiene gap.

Security policycaution

No repository security policy was found. This weakens disclosure transparency, but active commits, releases, tests, and organization backing provide meaningful compensation.

Workflow auditcaution

All 6 workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 18 action references are unpinned, which leaves workflow dependencies less reproducible and increases maintenance risk.