htmlnano

Lifecycle scriptscaution

The package runs a prepare lifecycle script during installation. This is not inherently unhealthy, but it adds install-time behavior that consumers should account for.

Project backingcaution

The repository owner is an individual user rather than an organization, so the highly concentrated commit activity is not buffered by visible organizational backing.

Repo bus factorcaution

Commit activity is highly concentrated: one contributor made 157 of 159 recent commits, or about 99%, despite a second contributor remaining active. That leaves a meaningful continuity risk.

Repo toolingcaution

The project uses TypeScript, webpack, SWC, and npm scripts, but no security-scanning tooling was detected, leaving a transparency and maintenance-control gap.

Security policycaution

The repository has no security policy, so users lack documented guidance for reporting vulnerabilities and understanding the project's security response.