es-object-atoms

Dangerous workflowscaution

Two of five workflows use pull_request_target, which requires elevated workflow-trust review, but there are no untrusted checkouts or script-injection findings.

Lifecycle scriptscaution

The package uses prepack and prepublish scripts, which add build-time supply-chain surface, although the repository's visible structure and tooling provide some compensating transparency.

Release historycaution

Five releases over about 2.5 years, with one release in the last 12 months and a median interval of about 152 days, indicate a deliberately slow maintenance cadence rather than rapid ongoing development.

Repo bus factorcaution

All three recent commits came from one contributor, creating a real continuity risk; organizational ownership partly compensates because maintenance can potentially be handed off.

Repo issue activitycaution

There is only one open issue and no recent issue or pull-request activity; for this small package that is not severe, but it offers limited evidence of a broader maintenance community.