@pnpm/ramda

Build provenancecaution

No build attestation or trusted-publisher information is provided, so consumers have limited cryptographic evidence about how this release was produced.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation, adding build-time behavior and review surface. No provided evidence shows that it is unsafe, so this is a limited transparency concern.

Release historycaution

This is the package's only release, published about four years ago, with no releases in the last 12 months. That materially raises staleness risk, although the linked repository remains active.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. This weakens evidence of current implementation work, although recent repository pushes and merged pull requests provide partial compensation.

Repo toolingcaution

The repository uses established build tools, but no security-scanning tools were detected. That is a hygiene gap rather than evidence that the package is unsafe.