deepmerge-ts

Dangerous workflowscaution

One of 17 workflows uses pull_request_target, but no untrusted checkout or script-injection patterns were detected. The isolated use is worth awareness but is not a severe health concern on these results.

Lifecycle scriptscaution

The package uses a prepare install-time lifecycle script, which adds execution during installation. This is a modest supply-chain and reproducibility concern, though the package also provides a built dist tree and has build tooling in the repository.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational succession signal to offset the concentrated maintainer base. The active owner still provides clear accountability.

Repo bus factorcaution

One human contributor made 44 of 48 recent commits, while the other four were made by semantic-release-bot. This concentrated human ownership creates a meaningful continuity risk despite the recent activity.

Repo toolingcaution

The project uses TypeScript, Rollup, Vitest, and related build tooling, supporting a reproducible development process. No security scanning tools were detected, leaving a modest security-process gap.