is-map

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less independently verifiable, though this is a transparency gap rather than evidence of unsafe code.

Dangerous workflowscaution

Five workflows were analyzed; two use pull_request_target, which warrants caution because that trigger can expose privileged workflow context, although no untrusted checkouts or script injection were detected.

Lifecycle scriptscaution

The package uses prepack and prepublish lifecycle scripts. These can affect publication and installation workflows, but no evidence here shows they execute risky install-time behavior.

Release historycaution

The package has existed since February 2015 but has only six releases, with no releases in the last 12 months and the latest release in March 2024. Its mature, narrow scope partly explains the slow cadence, but the gap lowers confidence in active maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent push history and mature package scope partly compensate, but the current inactivity is a maintenance concern.