array-includes

Build provenancecaution

No build attestation or trusted publisher identity is present, which reduces publication transparency; staged publishing and a named approver provide partial procedural compensation.

Dangerous workflowscaution

Two of six workflows use pull_request_target, creating elevated workflow review risk, but no untrusted checkout or script-injection patterns were detected.

Lifecycle scriptscaution

The package uses prepack and prepublish scripts, which add install or publication complexity, but these are common packaging hooks and no more severe behavior is shown.

Token permissionscaution

Five workflows declare read-only permissions, while one rebase workflow has top-level write permissions; the isolated write-capable workflow is a modest security-hygiene concern.