eslint-merge-processors

Lifecycle scriptscaution

A prepare script runs during installation, adding an install-time execution path. No provided signal shows that this script is harmful, so it is a modest supply-chain hygiene concern rather than a severe risk.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer represents a genuinely thin maintenance base rather than normal organization publishing hygiene.

Release historycaution

The package has four releases since December 2023, but none in the last 12 months; the latest release was published in February 2025. This is a meaningful maintenance concern for a dependency, though the package may be intentionally stable.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months, consistent with the lack of releases in the last year. This raises abandonment risk despite the package's stable state.

Repo toolingcaution

The project uses TypeScript, unbuild, npm scripts, and Vite, showing a defined build process, but no security scanning tools were detected. The missing scanning is a modest transparency gap.