is-core-module

Build provenancecaution

No build attestation is available, reducing publication transparency, but staged publishing and a named approver provide some process evidence.

Dangerous workflowscaution

Two workflows use pull_request_target, which deserves review because that trigger can run with elevated repository context, but the analyzed workflows show no untrusted checkout or script-injection findings.

Lifecycle scriptscaution

The package uses prepack and prepublish scripts, which add build-time supply-chain surface, but no evidence here shows that they are dangerous or install-time execution scripts.

Maintainerscaution

Only one registry account has publish access, which is a modest publishing-resilience concern, though repository-level organization backing provides some compensation.

Repo bus factorcaution

All recent commits came from one contributor, creating concentration risk; organization ownership partly mitigates the ability to hand maintenance to another contributor.