oidc-client-ts

Lifecycle scriptscaution

The package uses prepack and prepare scripts, which can add build-time supply-chain exposure, but their presence alone does not show harmful behavior.

Repo commit activitycaution

Only 3 commits from 2 active maintainers occurred in the last 3 months, which is modest activity, but it is consistent with the recent release history rather than clear abandonment.

Security policycaution

No repository security policy was found, leaving vulnerability reporting expectations undocumented for a security-sensitive authentication library.

Workflow auditcaution

All 10 action references are unpinned and the release workflow has top-level write permissions; the reported cache-poisoning finding is low confidence, with no untrusted checkout or script-injection path observed.