eslint-plugin-compat

Lifecycle scriptscaution

The package has a prepare install lifecycle script. This adds some install-time behavior, but the available signals do not show that it is unsafe or unusually broad.

Security policycaution

The repository has no security policy file, leaving vulnerability-reporting expectations less transparent for users and maintainers.

Workflow auditcaution

All nine analyzed action references are unpinned, and high-confidence low-severity adhoc-package findings occur in the release and test workflows. No untrusted checkout, script injection, or write-token exposure was found, limiting this to a hygiene concern.