is-localhost-ip

Lifecycle scriptscaution

A prepare script runs during installation or packaging, adding execution surface that deserves attention even though no harmful behavior is shown by this signal alone.

Maintainerscaution

Registry publishing access is held by one maintainer. The matching personal repository and recent release activity provide some compensation, but the project still has a thin bus factor.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, and its last push was about eight months ago. Recent releases provide limited compensation, but this weakens confidence in ongoing maintenance.

Security policycaution

No security policy is present in the repository, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All 10 analyzed action references are unpinned, and two workflows use top-level write permissions, creating avoidable workflow supply-chain and token-scope exposure. The cache-poisoning findings are low-confidence hygiene warnings, with no untrusted checkout or script-injection path detected.