string.prototype.codepointat

Build provenancecaution

No build attestation or trusted-publisher provenance is available, reducing publication transparency. The repository's publish-on-tag workflow and matching release provide partial context but do not replace an attestation.

Dangerous workflowscaution

Two workflows use pull_request_target, which deserves review because that trigger can run with elevated repository context. However, no untrusted checkouts or script-injection findings were detected, limiting the concern.

Release historycaution

The package has existed for over 12 years with five releases, but it had no releases in the last 12 months and its latest release was nearly two years before collection. Its long history supports maturity, while the prolonged gap warrants maintenance caution.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, indicating currently quiet maintenance. The recent release and established project history partly compensate, but this remains the main abandonment concern.

Repo toolingcaution

The repository reports no build tools or security-scanning tools, which is a transparency and maintenance-process gap for a published package.