compression-webpack-plugin

Lifecycle scriptscaution

A prepare script runs during installation, adding some install-time behavior; this is a modest concern without evidence here of unsafe commands or unusual side effects.

Repo bus factorcaution

All one recent commit came from a single contributor, creating concentrated maintenance risk; organization ownership provides some ability to hand work to others.

Repo commit activitycaution

Only one commit was recorded in the last three months, which is thin recent maintenance evidence despite the recent repository push and current release.

Workflow auditcaution

Both workflows use read-only permissions and the audit found no untrusted checkout or script-injection paths. However, all seven action references are unpinned, and a high-confidence low-severity finding reports an ad hoc package installation outside the lockfile.