isexe

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is available, leaving the connection between source and published artifact less independently verifiable.

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can increase CI risk when handling untrusted pull requests. No untrusted checkouts or script-injection patterns were detected, reducing the severity.

Lifecycle scriptscaution

A prepare install-time script is present, which adds some installation complexity and supply-chain exposure, although the package has no runtime dependencies and the repository shows an ordinary TypeScript build structure.

Maintainerscaution

Only one registry account has publish access. This is a meaningful bus-factor concern for release continuity, even though repository activity shows the package is actively published.

Project backingcaution

The repository is owned by an individual account rather than an organization. Combined with one registry maintainer and no recent commits, this leaves limited visible continuity beyond the recent release history.