to-buffer

Lifecycle scriptscaution

A prepack lifecycle script adds some build-time complexity, though this is less concerning than an install-time script and no other evidence indicates unsafe installation behavior.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful sign of currently slow maintenance despite the recent release and push timestamp.

Repo toolingcaution

The repository uses TypeScript build tooling, but no security-scanning tool was detected, leaving a modest transparency and hygiene gap.

Workflow auditcaution

All six workflows were analyzed with no audit findings or untrusted checkouts, but all six action references are unpinned, reducing build reproducibility and increasing update risk.