minipass

Lifecycle scriptscaution

The package runs a prepare script during installation, adding build or install-time behavior that consumers should account for even though no other lifecycle concern is shown.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months, limiting evidence of active development despite the recent registry release.

Repo toolingcaution

The repository uses TypeScript build tooling, but no security scanning tools were detected, leaving a modest source-level hygiene gap.

Workflow auditcaution

Both workflows were analyzed with no audit findings or untrusted checkout and injection sinks, but all 7 action references are unpinned and one workflow has top-level write permissions.