@vscode/test-electron

Build provenancecaution

The release has no attestation and does not use staged publishing, leaving the registry artifact's build origin less verifiable. This is a transparency gap, partly offset by the visible repository and matching package structure.

Lifecycle scriptscaution

The package uses prepack and prepare lifecycle scripts, which can execute during installation or packaging and add build-time complexity. Their names are consistent with normal source preparation, so this is a limited concern rather than a severe risk.

Repo issue activitycaution

The repository has two new issues and no issues closed in the last month, although three pull requests were merged. This suggests some unresolved maintenance backlog but not clear abandonment.

Repo toolingcaution

The project uses TypeScript and Vitest and has build tooling, but no security-scanning tools were detected. The missing scanning reduces maintenance and supply-chain hygiene.