is-descriptor

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This limits publication transparency, although it is a hygiene gap rather than evidence of an unsafe release.

Lifecycle scriptscaution

The package defines prepack and prepublish lifecycle scripts. These are not inherently unsafe, but they add installation and publication complexity compared with a package without lifecycle automation.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Recent releases and a recent repository push partly offset this, but the current development cadence is a concern.

Repo issue activitycaution

There are no open issues or pull requests, and no issue or pull-request activity occurred in the last month. This is mildly reassuring for backlog health but provides little evidence of active community maintenance.

Workflow auditcaution

All six workflows were analyzed successfully with no reported audit findings or untrusted checkouts. However, all six action references are unpinned, and one workflow grants top-level write permissions, creating moderate workflow hygiene risk.