symbol.prototype.description

Build provenancecaution

No build attestation or trusted-publisher identity is present. This weakens publication transparency, but it is not by itself evidence that the release is unsafe.

Lifecycle scriptscaution

The package uses prepack and prepublish lifecycle scripts, which add build-time execution during publication. This is a modest supply-chain hygiene concern, not evidence that installation executes a script.

Repo commit activitycaution

There were no commits or active maintainers in the last 3 months. That is a maintenance caution, though the recent release and January 2026 push partly compensate for the short observation window.

Workflow auditcaution

All 5 workflows were analyzed without audit findings or untrusted checkouts, and pull_request_target is used without a detected sink. However, all 5 action references are unpinned, leaving a reproducibility and action-substitution gap.