foreground-child

Lifecycle scriptscaution

A prepare install-time script is present, which adds some installation complexity compared with a package containing no lifecycle scripts. The available evidence does not show that it performs a dangerous action.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Recent registry releases and the May 2026 push partly offset this, but the pause is a meaningful maintenance caution.

Repo toolingcaution

TypeScript build tooling is present, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene gap, not evidence of abandonment.

Workflow auditcaution

Both workflows were analyzed with no reported audit findings or untrusted checkouts. However, all seven action references are unpinned and one workflow grants top-level write permissions, creating avoidable workflow-reproducibility and permission concerns.