core-js-pure

Lifecycle scriptscaution

A postinstall script adds execution during installation and deserves review because it increases the package's install-time behavior beyond ordinary file delivery.

Repo bus factorcaution

Five contributors were active, but the primary contributor made about 94% of the 84 recent commits, leaving maintenance capacity highly concentrated.

Repo toolingcaution

The project uses Babel and npm build tooling, but no security scanning tools were detected; this is a modest transparency and hygiene gap, not evidence of abandonment.

Workflow auditcaution

All five workflows were analyzed with no detected injection or high-severity findings, but all 38 action references are unpinned and one workflow grants top-level write access, creating reproducibility and permissions concerns.