aria-hidden

Lifecycle scriptscaution

The package declares prepare and prepublish lifecycle scripts. These can run package-controlled commands during installation or publication, so they add some installation complexity even though the signal does not show malicious behavior.

Maintainerscaution

Only one registry account has publish access, leaving limited publishing redundancy. The linked repository is user-owned rather than organization-backed, so no provided signal compensates for that concentration.

Release historycaution

The package has 12 releases since October 2018, but none in the last 12 months; the latest release was published in May 2025. This indicates a mature but currently inactive release cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. Combined with no releases in the last 12 months, this is evidence of stalled maintenance.

Repo toolingcaution

The repository uses TypeScript and npm scripts, but no security scanning tools were detected. The missing scanning is a modest hygiene gap, not evidence that the package is unsafe.