eslint-plugin-cypress

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, leaving publication provenance less transparent than it could be.

Dangerous workflowscaution

One of two analyzed workflows uses pull_request_target, which can warrant elevated trust scrutiny, but there are no detected untrusted checkouts or script-injection patterns.

Lifecycle scriptscaution

A prepare install-time script introduces some supply-chain and installation complexity, although this signal alone does not show malicious behavior or an unsafe script.

Repo toolingcaution

The repository uses build tooling including Vitest and TypeScript, but has no detected security-scanning tools; the tooling is healthy while security automation remains a gap.

Security policycaution

No repository security policy was found, reducing transparency around vulnerability reporting and response expectations.