teeny-request

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less independently verifiable despite the active project backing.

Lifecycle scriptscaution

A prepare script runs during installation, adding build-time behavior and a small amount of supply-chain complexity, but the signal does not indicate a malicious or unusually risky command.

Repo package mentioncaution

The linked repository name does not match teeny-request and its README does not mention the package, creating uncertainty about whether the repository directly represents this package; the mismatch may also reflect a monorepo.

Workflow auditcaution

The audit analyzed 18 of 19 workflows, so coverage is incomplete. It found two high-confidence low-severity adhoc-package installations and one workflow with top-level write permissions, but no unpinned actions or untrusted checkout findings.