tap-parser

Licensecaution

The artifact includes a LICENSE file and the repository also has one, but the manifest declares BlueOak-1.0.0 while the detected file license is MIT; that mismatch warrants clarification.

Lifecycle scriptscaution

A prepare script runs during package lifecycle operations, adding install-time behavior beyond the package's runtime code; the signal provides no evidence that it is harmful.

Repo toolingcaution

The project uses TypeScript, Nx, esbuild, and npm scripts for builds; no security scanning tools were detected, a modest transparency gap.

Workflow auditcaution

Both workflows were fully analyzed with no reported audit findings or untrusted checkout and script-injection paths. However, all 7 action references are unpinned and one workflow grants top-level write permissions, creating moderate workflow hygiene concerns.