side-channel-map

Lifecycle scriptscaution

The package declares prepack and prepublish scripts, adding build-time execution during publication. These are not consumer install scripts, so they are a limited concern rather than a severe dependency risk.

Release historycaution

The package has only two releases, both published in December 2024, with no releases in the last 12 months. That is a meaningful maintenance concern for a dependency, although the stable 1.0.1 version may need few changes.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with a largely inactive project. A push occurred in December 2025, so the repository is not clearly abandoned.

Workflow auditcaution

All six analyzed workflow action references are unpinned, which weakens build reproducibility. The pull_request_target workflows have no untrusted checkout or script-injection findings, and the audit completed without failures.