html-to-image

Dangerous workflowscaution

Eight of 15 workflows use pull_request_target, which can increase CI exposure when handling untrusted pull requests; no untrusted checkouts or script-injection patterns were detected, partly compensating for the concern.

Lifecycle scriptscaution

A prepare install-time script is present, adding some installation complexity and execution risk, although the package has no runtime dependencies and has a documented build structure.

Project backingcaution

The repository is owned by an individual account rather than an organization, so continuity depends on a relatively narrow project backing model.

Release historycaution

The project has 73 releases over more than 8 years, but the latest registry release was about 19 months ago and there were no releases in the last 12 months, indicating slowed delivery.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months, a meaningful maintenance concern despite the recent repository push date.