isbot

Build provenancecaution

No build attestation or trusted publisher identity is present, so consumers cannot independently verify how this release was produced. This is a transparency gap, though it does not outweigh the package's strong maintenance evidence.

Lifecycle scriptscaution

The package uses a prepare lifecycle script, which can add install-time behavior and deserves review. However, the repository shows an established build structure and the package has no runtime dependencies, limiting the concern.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no organizational maintenance cushion. The two active contributors and sustained release activity partly compensate for that limitation.

Token permissionscaution

Both workflows declare top-level write permissions. Although explicit permissions are better than omitted permissions, broad write access increases the potential impact of a workflow compromise and merits caution.