package-json-from-dist

Lifecycle scriptscaution

A prepare lifecycle script runs during installation or package preparation, adding some install-time behavior that deserves review even though no other workflow risk is shown.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer and quiet activity provide limited evidence of maintenance redundancy.

Release historycaution

Only two releases exist, with the latest published about two years ago and no releases in the last 12 months. This is consistent with a small stable utility but reduces evidence of ongoing maintenance.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, and the repository was last pushed about two years ago. For a small utility this may reflect stability, but it is still a meaningful maintenance concern.

Repo toolingcaution

The repository uses TypeScript build tooling, but no security-scanning tools were detected. This is a modest transparency and assurance gap rather than a severe risk.