hasown

Build provenancecaution

No registry build attestation or trusted-publisher provenance is available, so consumers have less independently verifiable evidence connecting the artifact to its source.

Dangerous workflowscaution

Two workflows use pull_request_target, which can require careful handling of untrusted contributions; however, no untrusted checkouts or script-injection patterns were detected.

Lifecycle scriptscaution

The package uses prepack and prepublish lifecycle scripts, which add some installation and publication complexity even though these scripts are not install-time execution hooks.

Repo bus factorcaution

One contributor made all four commits in the last three months, creating concentration risk; organization backing provides some ability to hand maintenance off, but no second recent contributor is shown.

Token permissionscaution

Five workflows declare read-only permissions, but rebase.yml has top-level write permissions, increasing the potential impact of workflow compromise.