danger

Lifecycle scriptscaution

The package uses a prepare install-time script. This is not inherently unhealthy, but it adds installation behavior that consumers should account for.

Repo toolingcaution

The project uses TypeScript, Babel, and npm build tooling, but no security-scanning tools were detected; the missing scanning is a modest hygiene gap.

Workflow auditcaution

All four workflows were analyzed, with no untrusted checkouts or script-injection findings, but all 12 action references are unpinned and the audit found a high-confidence template-injection issue plus adhoc package installs.