jscodeshift

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers cannot independently verify how this release was produced. The established source repository partly offsets, but does not remove, this transparency gap.

Lifecycle scriptscaution

The package uses a prepare lifecycle script. This is common for build or publication setup, but it adds install-time behavior that merits awareness.

Release historycaution

The project has 72 releases over more than 11 years, but only one release in the last 12 months. That recent slowdown is a maintenance concern, though the latest release is current and the repository remains active.

Repo toolingcaution

The project uses TypeScript and Babel build tooling, but no repository security-scanning tool was detected. This is a modest transparency gap rather than evidence of abandonment.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkouts, script injection, or audit findings, and one scopes permissions at job level. However, all seven analyzed action references are unpinned, leaving them exposed to upstream reference changes.