iterate-value

Lifecycle scriptscaution

A prepublish lifecycle script is present, adding some publishing complexity, but this alone is not evidence of unsafe installation behavior.

Project backingcaution

The repository is owned by an individual rather than an organization, so continuity depends on a relatively narrow project owner base.

Release historycaution

Only three releases exist, with the latest published in January 2020 and none in over six years. This is a meaningful freshness concern for the assessed release, although the repository has newer activity.

Repo commit activitycaution

There were no commits or active maintainers in the measured three-month window, so current maintenance is not demonstrated despite the repository's more recent push.

Workflow auditcaution

All six action references are unpinned, weakening build reproducibility. The pull_request_target workflows have no untrusted checkouts or script-injection findings, and no workflow has top-level write permissions, so this remains a hygiene concern rather than a severe risk.