ipull

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers cannot independently verify how this release artifact was produced.

Dependency profilecaution

Twenty runtime dependencies create a moderately broad dependency surface for a downloader and increase the amount of transitive code consumers must trust and maintain.

Lifecycle scriptscaution

A prepack script runs during packaging. This is not inherently unsafe, but it adds build-time complexity compared with a package without lifecycle scripts.

Maintainerscaution

Only one registry account has publish access, leaving the release process dependent on a single person; the repository is user-owned rather than organization-backed, so there is no provided ownership evidence to compensate for that concentration.

Project backingcaution

The repository is owned by the same individual account associated with the package, which supports ownership alignment but provides no organization-level continuity or maintainer redundancy.