is-nan

Dangerous workflowscaution

Two of five workflows use pull_request_target, which warrants care because that trigger can expose elevated automation context. However, no untrusted checkouts or script-injection patterns were detected.

Lifecycle scriptscaution

A prepublish lifecycle script is present. This is not evidence of a harmful package by itself, but it adds avoidable publication or installation complexity compared with a package without lifecycle scripts.

Release historycaution

The package has existed since January 2014 with nine releases, but its latest registry release was in December 2020 and there were no releases in the last 12 months. The repository's later push provides some compensation, but the published release cadence remains stale.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. The recent repository push offsets a full abandonment judgment, but current maintenance activity is still weak.

Token permissionscaution

All five analyzed workflows omit top-level token permissions, so their default access is not explicitly constrained. No workflow declares top-level write access, but the missing restrictions are a meaningful hygiene gap.