set-cookie-parser

Lifecycle scriptscaution

A prepare lifecycle script runs during installation or publication. This is a mild supply-chain and reproducibility consideration, although the signal does not show that the script is unsafe.

Repo bus factorcaution

Two contributors were active recently, with the top contributor responsible for two-thirds of commits; this is somewhat concentrated but not a single-contributor project.

Repo toolingcaution

The project uses npm build tooling, but no repository security-scanning tool was detected, leaving a modest security-process gap.

Security policycaution

No security policy was found in the repository, reducing the transparency of vulnerability reporting and response expectations.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings, no untrusted checkout or script-injection paths, and job-level permissions. All 4 action references are unpinned, which weakens build reproducibility and action supply-chain hygiene.