qs

Build provenancecaution

No build attestation is present, so consumers have less independently verifiable evidence connecting the published artifact to its source. Staged publishing and an approver provide some compensating release control.

Dangerous workflowscaution

Two workflows use pull_request_target and therefore deserve review, but none uses untrusted checkouts or detected script injection. The observed workflow profile is a limited caution rather than a severe health risk.

Lifecycle scriptscaution

The package uses prepack and prepublish lifecycle scripts, adding install or publication complexity. This is a supply-chain consideration, though the broader repository and release evidence shows an established project.

Repo bus factorcaution

One maintainer made 32 of 36 recent commits, creating concentration risk despite four other contributors remaining active. The repository is user-owned rather than organization-owned, so this concentration is a genuine caveat.

Token permissionscaution

Five workflows declare read-only permissions, while only rebase.yml has top-level write permissions. This is mostly restrictive, with one higher-privilege workflow warranting review.