node-exports-info

Build provenancecaution

No build attestation is available, limiting publication transparency, although staged publishing and a named approver provide some process control.

Lifecycle scriptscaution

The package uses prepack and prepublish scripts, which can add build-time complexity and execution surface, though these are packaging stages rather than evidence of abandonment.

Maintainerscaution

Only one registry publishing account is listed, which creates publishing continuity risk; the repository's organization backing provides some compensation.

Workflow auditcaution

All 6 workflows were analyzed with no audit findings and no untrusted checkout or script-injection sinks. However, all 6 action references are unpinned, and one workflow has top-level write permissions, creating moderate workflow hygiene risk without a dangerous trigger-and-sink combination.