nth-check

Lifecycle scriptscaution

A prepare install-time script is present, which adds some install-process complexity, although the package also has source files, build tooling, and provenance.

Project backingcaution

The repository is owned by an individual rather than an organization, so continuity depends on a relatively narrow project owner base.

Security policycaution

No repository security policy was found, leaving disclosure guidance unclear; this is a minor transparency gap rather than evidence of abandonment.

Workflow auditcaution

All four workflows were analyzed, but one high-confidence bot-conditions finding affects the Dependabot auto-merge workflow, eight of ten action references are unpinned, and one workflow has top-level write access. The cache-poisoning finding is low confidence and carries little weight alone.