eslint-plugin-testing-library

Lifecycle scriptscaution

A prepare lifecycle script runs during installation or package preparation, adding some execution surface that consumers should account for, even though this is common for built packages.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months, which is a maintenance warning; recent releases and merged pull requests provide only partial compensation.

Repo toolingcaution

The repository uses TypeScript, Vitest, and npm build tooling, but no security-scanning tool was detected, leaving a modest transparency and assurance gap.

Security policycaution

The repository has no security policy, reducing clarity about vulnerability reporting and response expectations.

Workflow auditcaution

All four workflows were analyzed and all 15 action references are pinned, with no untrusted checkout or script-injection findings. However, three workflows grant top-level write permissions, and high-severity cache-poisoning was reported only with low confidence; two high-confidence adhoc-package findings are hygiene concerns.