ofetch

Lifecycle scriptscaution

A prepack script runs during packaging. This is not inherently unsafe, but it adds build-time behavior that consumers should understand when evaluating release reproducibility.

Repo issue activitycaution

There are ongoing pull requests and newly opened issues, although none of the 10 recent pull requests were merged in the measured month, which is a mild maintenance concern.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts, showing established build and test tooling. No security scanning tool was detected, leaving a minor process gap.

Security policycaution

The repository has no security policy, reducing transparency around vulnerability reporting and response expectations.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings, and one workflow uses read-only permissions. However, five of six action references are unpinned, weakening build reproducibility and update safety.