cosmiconfig

Lifecycle scriptscaution

A prepare install-time script adds some installation complexity and execution surface, though this is a common publishing workflow and no harmful behavior is shown.

Repo toolingcaution

The project uses TypeScript, Vite, and npm build tooling, but no security-scanning tools were detected; this is a modest transparency gap rather than evidence of abandonment.

Security policycaution

No security policy was found in the repository, leaving vulnerability-reporting expectations unclear for a widely used library.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no dangerous triggers or audit findings. However, all three action references are unpinned, creating a minor reproducibility and workflow supply-chain hygiene gap.