form-data

Build provenancecaution

Staged publishing with a named approver provides some process control, but the release has no attestation or trusted-publisher identity, limiting verification of artifact origin.

Dangerous workflowscaution

Two of five workflows use pull_request_target, which carries elevated workflow risk, but none use untrusted checkouts or detected script injection.

Lifecycle scriptscaution

The package defines postpack, prepack, and prepublish lifecycle scripts, which add publishing complexity and warrant review, although they are not shown to be malicious or install-time execution scripts.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last 3 months, a meaningful sign of slowed maintenance; the recent release and repository push provide some compensating evidence but do not remove the concern.

Repo issue activitycaution

There were no new or closed issues and no new or merged pull requests in the last month, while 113 issues and 28 pull requests remain open; this indicates a currently quiet issue-management process.