typed-array-byte-offset

Build provenancecaution

Staged publishing is enabled, but no build attestation or trusted publisher identity is present, leaving publication provenance less independently verifiable.

Dangerous workflowscaution

Two of seven workflows use pull_request_target, which requires elevated trust because it can run with repository privileges, but there are no untrusted checkouts or script-injection findings.

Dependency profilecaution

Six runtime dependencies create some transitive supply-chain surface for a small utility, but the dependency list is focused on related typed-array and JavaScript compatibility helpers rather than unusually broad functionality.

Lifecycle scriptscaution

The package uses prepack and prepublish lifecycle scripts, which add install and publication complexity; no provided signal shows that these scripts are unsafe, so this is a limited concern rather than a severe risk.

Release historycaution

The package has existed for about 3 years and released version 1.0.5 on the assessment date, but only one release occurred in the last 12 months and the median interval is about 256 days, indicating modest rather than rapid maintenance.