pvutils

Lifecycle scriptscaution

A prepare lifecycle script is present, which can add install-time behavior, but this signal alone does not show harmful or unnecessary activity.

Repo toolingcaution

The project uses TypeScript, Rollup, Vitest, and npm scripts for builds and tests. No security scanning tooling is configured, which is a modest transparency gap.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures undocumented.

Workflow auditcaution

All 10 analyzed action references are unpinned, and the release workflow has a high-confidence template-injection finding plus top-level write permissions. No untrusted checkout or injection sink was reported alongside a dangerous trigger, so these are workflow hygiene concerns rather than a standalone severe risk.