ow

Lifecycle scriptscaution

A prepare script runs during installation, adding build-time behavior that deserves attention, although this is not by itself evidence of abandonment or severe dependency risk.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer reflects a genuinely thin publisher base rather than organizational publishing hygiene.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. The recent release and two releases in the last year partly compensate, but the short-term inactivity remains a maintenance caution.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected, leaving a modest transparency and hygiene gap.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, all three action references are unpinned, weakening build reproducibility and supply-chain hygiene.