fetch-cookie

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, leaving the relationship between the published artifact and its source less verifiable.

Lifecycle scriptscaution

The package uses prepack and prepare lifecycle scripts. These can be legitimate build or packaging steps, but they add install-time execution surface and the signal does not show what those scripts do.

Project backingcaution

The repository is owned by an individual rather than an organization, so continuity depends on a relatively narrow project base. This is partly offset by the package's long history and recent release.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. The recent release and push provide some compensating evidence, but the lack of ongoing development is a maintenance caveat.

Repo toolingcaution

The repository uses TypeScript, npm scripts, and esbuild for builds, but reports no security scanning tools. The build setup is present, while security-tooling coverage is limited.