eslint-plugin-jsdoc

Lifecycle scriptscaution

The package has a prepare install lifecycle script, which adds install-time execution surface; this is a modest supply-chain hygiene concern despite the available build provenance.

Repo bus factorcaution

One contributor made about 69% of recent commits, but seven other contributors were active during the same period; this is concentration risk rather than an abandonment signal.

Repo toolingcaution

The project uses TypeScript, Babel, and npm build tooling, but no security-scanning tools were detected, leaving a modest repository hygiene gap.

Security policycaution

No repository security policy was found, reducing transparency for reporting and handling vulnerabilities.

Workflow auditcaution

Both workflows were analyzed without high- or medium-severity findings, and one workflow scopes permissions at job level. However, all 12 action uses are unpinned and a high-confidence audit found an ad hoc package installation, so workflow reproducibility is weaker.