string.prototype.matchall

Build provenancecaution

No build attestation is present, so consumers cannot independently verify this release's build origin. Staged publishing and a named approver provide some process control but do not provide verifiable provenance.

Dependency profilecaution

Thirteen runtime dependencies create a meaningful dependency surface for a small shim, increasing maintenance and transitive-risk exposure even though the package has a long release history.

Repo bus factorcaution

All 14 recent commits came from one contributor, creating a real continuity risk. Organization ownership partly compensates because maintenance can potentially be handed off.

Workflow auditcaution

All six workflows were analyzed with no reported audit findings, five workflows use read-only permissions, and the pull_request_target workflows have no untrusted checkouts or script-injection sinks. However, all six action references are unpinned, which weakens build reproducibility and action supply-chain hygiene.