get-intrinsic

Build provenancecaution

No build attestation or trusted publisher identity is available, leaving the relationship between the published artifact and its source less independently verifiable.

Dangerous workflowscaution

Two of six workflows use pull_request_target, which warrants caution because that trigger can expose elevated workflow context to pull requests. No untrusted checkout or script injection was detected.

Dependency profilecaution

The package has 10 runtime dependencies for a small JavaScript utility, increasing dependency surface somewhat, but the dependencies are explicitly declared and appear purpose-specific.

Lifecycle scriptscaution

The package uses prepack and prepublish lifecycle scripts, which add publishing and installation-adjacent complexity compared with a package containing no lifecycle scripts.

Maintainerscaution

Only one registry account has publish access, creating a narrow publishing base. The matching source repository and recent activity partly offset the bus-factor concern, but do not remove it.