ts-proto

Licensecaution

The package declares ISC, while its included LICENSE file is detected as Apache-2.0; although a license is present, the mismatch should be resolved before adoption.

Lifecycle scriptscaution

A prepare script runs during installation or package preparation, adding build-time execution complexity, though this is common for source-oriented npm packages.

Repo toolingcaution

The project uses TypeScript and npm scripts, but no repository security-scanning tools were detected; this is a modest transparency gap rather than evidence of unsafe code.

Security policycaution

No security policy was found in the repository, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All seven analyzed action references are unpinned, which weakens build reproducibility. The audit found no untrusted checkout, script injection, or high-confidence workflow findings, and the pull_request_target trigger has no identified sink.