array-buffer-byte-length

Build provenancecaution

No build attestation or trusted-publisher setup was observed, reducing publication transparency. This is a supply-chain hygiene gap rather than evidence that the release is unsafe.

Lifecycle scriptscaution

The package declares prepack and prepublish lifecycle scripts. These can add build-time complexity, but the available packaging and repository structure provide context rather than evidence of an unsafe install hook.

Release historycaution

The package has only 3 releases and none in the last 12 months; the latest release was about 21 months ago. This is a meaningful maintenance concern for a dependency, though the package may be stable and small.

Repo commit activitycaution

The repository had 0 commits and 0 active maintainers in the last 3 months, indicating currently quiet maintenance and increasing abandonment risk.

Workflow auditcaution

All 6 workflows were analyzed with no reported audit findings, and 5 use read-only permissions. However, all 6 action references are unpinned, leaving a reproducibility and action-substitution hygiene gap; the pull_request_target triggers had no untrusted checkouts or script injection.