ink

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the relationship between source and published artifact less independently verifiable.

Dependency profilecaution

The package has 23 runtime dependencies, a meaningful transitive maintenance surface for a library, though the profile is consistent with a terminal UI renderer's functionality.

Lifecycle scriptscaution

The package defines a prepare install-time lifecycle script, which adds execution during installation and modestly increases dependency-install complexity.

Repo bus factorcaution

One contributor made about 72% of recent commits, but six other contributors were active in the same 3-month period, partly reducing concentration risk.

Repo toolingcaution

The project uses TypeScript, esbuild, and npm scripts for builds, but no security-scanning tools were detected, leaving a modest assurance gap.