cliui

Build provenancecaution

No build attestation or trusted publisher information is present, leaving the relationship between the published artifact and source repository less transparent.

Lifecycle scriptscaution

The package uses a prepare install-time lifecycle script, which adds build or installation behavior that consumers should review, but this alone is not evidence that the release is unfit.

Release historycaution

The package has a long history with 27 releases, but no registry release in the last 12 months; the latest release was about 18 months ago. Active repository work partly offsets this, but registry maintenance appears slow.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected; this is a modest process gap rather than evidence of abandonment.

Token permissionscaution

One workflow lacks top-level permissions and another grants top-level write access, leaving workflow privileges less restrictive than ideal and increasing automation exposure.