isobject

Lifecycle scriptscaution

A prepublish lifecycle script is present, which adds some release-process complexity, but it is not an install-time script such as postinstall and is therefore only a minor concern.

Repo bus factorcaution

All eight recent commits came from one contributor, leaving maintenance dependent on a single active person and creating a meaningful continuity risk.

Repo toolingcaution

The project uses npm scripts and Rollup, but no security scanning tools were detected. For this small package, that is a modest transparency and defense-in-depth gap.

Workflow auditcaution

All workflows were analyzed, all nine action references are pinned, and no untrusted checkout or script injection was found. The release workflow has top-level write permissions plus a low-confidence cache-poisoning finding and a high-confidence adhoc-package installation, which are workflow hygiene concerns rather than standalone severe risks.