appium-adb

Lifecycle scriptscaution

The package runs a prepare install-time script. This adds build-time execution during installation, but the signal alone does not show unsafe behavior and is consistent with a compiled TypeScript package.

Maintainerscaution

Five registry accounts have publish access, with two using the Sauce Labs domain and three using Gmail addresses: jlipps, nick.mokhnach, and kazucocoa. Because the repository is organization-owned, the outside mailbox accounts are an account-hygiene caution rather than evidence of a one-person project.

Repo commit activitycaution

No commits and no active maintainers were recorded in the last three months. Recent releases and eight merged pull requests partly offset this, but the direct-commit inactivity remains a maintenance warning.

Workflow auditcaution

All nine workflows were analyzed with no reported audit findings, no untrusted checkouts, and no script-injection paths. However, all 25 action references are unpinned, and two release workflows grant top-level write access, creating a workflow hygiene and update-integrity concern.