eta

Lifecycle scriptscaution

The package uses a prepare install-time script. This is not inherently unsafe, but it adds installation behavior that consumers should account for.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern, although the package still published nine releases in the last year.

Repo toolingcaution

The repository uses TypeScript, Vitest, and build tooling, but no security scanning tools were detected. The development setup is solid while security automation coverage is limited.

Security policycaution

No repository security policy was found, reducing transparency for reporting and handling vulnerabilities.

Workflow auditcaution

All 13 analyzed action references are unpinned, and a high-confidence low-severity finding reports an ad hoc package installation outside the lockfile. One workflow has a pull_request_target trigger, but no untrusted checkout or script-injection sink was detected; top-level write permissions in two workflows remain a mild hygiene concern.