string.prototype.padstart

Dangerous workflowscaution

Two of five workflows use pull_request_target, which warrants caution because that trigger can expose elevated repository context, although no untrusted checkout or script injection was detected.

Dependency profilecaution

The package has five runtime dependencies for a small standards shim; this is not excessive, though it adds maintenance surface compared with a dependency-free implementation.

Lifecycle scriptscaution

The package uses prepack and prepublish lifecycle scripts, which create install or publication complexity, although these names alone do not show malicious behavior.

Release historycaution

The package has existed since 2015 with nine releases, but it has had no release in the last 12 months, indicating slow maintenance for a dependency that may still be stable.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign of currently inactive development that is partly consistent with this mature, stable shim.