acorn-loose

Build provenancecaution

No build attestation or trusted-publisher provenance is available, reducing publication transparency, although this is not evidence that the release is unsafe by itself.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation, which adds some install-time complexity and supply-chain exposure, though no other provided signal indicates dangerous workflow behavior.

Release historycaution

There have been no registry releases in the last 12 months, which is a maintenance concern, but the repository shows recent commit and issue activity that partly offsets abandonment risk.

Repo toolingcaution

The repository uses established build tooling, including Rollup, npm scripts, and Babel. No security scanning tool was detected, leaving a modest security-process gap.

Security policycaution

The repository has no published security policy, reducing transparency about vulnerability reporting and response expectations.