ramda

Lifecycle scriptscaution

The package uses a prepare script, which can run during installation or publishing and deserves review. No provided signal shows that it performs unsafe behavior, so this is only a mild supply-chain consideration.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. Although pull requests were merged and the repository was recently pushed, the lack of recent commit activity is a meaningful maintenance warning.

Repo toolingcaution

The repository uses established build tools, but no security scanning tools were detected. Build automation is present; the missing scanning is a modest transparency and hygiene gap.

Type declarationscaution

No type declarations are included, which adds integration work for TypeScript consumers. This is a consumer-ergonomics gap rather than evidence of weak maintenance.

Workflow auditcaution

Both workflows were analyzed with no audit findings, no untrusted checkouts, and no script injection; one workflow scopes permissions at job level. However, all four analyzed action references are unpinned, leaving avoidable reproducibility and action-substitution risk.