opensea-js

Registry deprecationdanger

npm marks the entire package deprecated and tells consumers to install @opensea/sdk instead. This is a direct reason not to start a new dependency on this release.

Lifecycle scriptscaution

A postinstall script runs during installation, adding executable install-time behavior that consumers must trust. No provided signal shows that this script is harmless or necessary.

Package file treecaution

The artifact contains only package.json and postinstall.js, making the published contents unusually minimal and leaving the install-time script central to installation behavior. The much larger repository provides source transparency but does not remove this artifact-level concern.

Type declarationscaution

No type declarations are included, which is a real integration gap for a JavaScript SDK commonly consumed by typed projects. The repository's TypeScript tooling does not show that declarations reach this artifact.

Workflow auditcaution

All workflows were analyzed without untrusted checkouts or script injection, but all four action references are unpinned and a high-confidence medium-severity secrets-inherit finding affects the publishing workflow. These are avoidable supply-chain hygiene concerns.