media-typer

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the otherwise transparent repository and release evidence.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation or packaging. This is not inherently unsafe, but it adds install-time behavior that deserves awareness compared with a package having no lifecycle scripts.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a maintenance concern partly offset by the recent registry release and push.

Workflow auditcaution

All three workflows were analyzed successfully, use read-only permissions, and have no high-confidence audit findings. However, 7 of 11 action references are unpinned, which weakens build reproducibility and update safety.