eslint-webpack-plugin

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, leaving the artifact-to-source build path less independently verifiable despite the matching maintained repository.

Lifecycle scriptscaution

A prepare install-time script is present, adding some installation complexity and execution surface, but this signal alone does not show harmful behavior.

Workflow auditcaution

All three workflows were analyzed, all ten action references are pinned, and no untrusted checkout or script-injection paths were found. One release workflow has top-level write permissions and the audit found two high-confidence low-severity ad hoc package-install findings, so workflow hygiene is not perfect.