has-tostringtag

Dangerous workflowscaution

Two workflows use pull_request_target, creating a workflow-security consideration, but none use untrusted checkouts or detected script injection.

Lifecycle scriptscaution

The package uses prepack and prepublish scripts, which can affect publication behavior and merit review, but these are build-time scripts rather than evidence of an install-time payload.

Release historycaution

There have been only three releases and no releases in the last 12 months; the latest release was about two years ago. This limits evidence of ongoing release maintenance, though the package may be intentionally stable.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which weakens evidence of current maintenance capacity. The recent repository push and organization backing provide some compensation.

Token permissionscaution

Ten workflows declare read-only permissions and none declare top-level write permissions. Four workflows omit top-level permissions, leaving a modest configuration gap.