jackspeak

Lifecycle scriptscaution

A prepare script runs during installation. This is not inherently unsafe, but install-time execution increases build and supply-chain complexity for consumers.

Project backingcaution

The repository is owned by the individual user isaacs rather than an organization, so the single-owner context offers less maintainer redundancy.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern, although recent registry releases provide some counterevidence.

Repo toolingcaution

The project uses TypeScript, npm scripts, and esbuild, showing an established build process, but no security scanning tools were detected.

Workflow auditcaution

Both workflows were analyzed successfully with no untrusted checkouts, script injection, or auditor findings. However, all seven action references are unpinned and one workflow grants top-level write permissions, creating avoidable workflow-integrity and token-scope concerns.