contentful-management

Lifecycle scriptscaution

The package runs a prepare install-time lifecycle script. This is a modest supply-chain and installation-complexity consideration, but the attested build and active repository provide compensating transparency.

Repo toolingcaution

The project uses TypeScript, Rollup, Vitest, and npm scripts for building and testing. No security scanning tooling was detected, which is a minor hygiene gap rather than a maintenance concern.

Workflow auditcaution

All six workflows were analyzed with no failed files, untrusted checkouts, script injection, or unpinned actions; however, two high-confidence medium findings report secrets-inherit and two low findings report ad hoc package installs in the release workflow.