nlcst-to-string

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent, though this is not by itself evidence that the package is unsafe.

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can require elevated trust handling and increases workflow-maintenance risk even though no untrusted checkout or script injection was detected.

Release historycaution

The package has a long history with 21 releases, but its latest release was about three years ago and there were no releases in the last 12 months, lowering confidence in ongoing maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, reinforcing the concern that maintenance has slowed or stopped.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security-scanning tools were detected, leaving a modest security-hygiene gap.