basic-ftp

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers cannot independently verify how the published artifact was produced.

Lifecycle scriptscaution

The package defines a prepare lifecycle script, which runs package-manager-controlled code during installation or preparation and adds some supply-chain exposure. No other lifecycle-script evidence was provided to show whether this is necessary or benign.

Repo bus factorcaution

All 12 recent commits came from one contributor, creating a meaningful continuity risk despite the project's active history.

Repo toolingcaution

The project uses TypeScript for its build, but no repository security-scanning tools were detected. The missing scanning is a modest transparency gap, not evidence of unsafe code.

Workflow auditcaution

Both workflows were analyzed successfully with no injection, untrusted-checkout, or high-severity findings, and permissions are scoped or read-only. However, all four referenced actions are unpinned, leaving workflow behavior exposed to upstream action changes.