typescript-language-server

Lifecycle scriptscaution

A prepare script runs during installation, which adds build or install-time behavior that should be understood before depending on the package, but it is not by itself evidence of poor project health.

Repo toolingcaution

The project uses TypeScript, Rollup, Vitest, Babel, and npm scripts, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

All 12 analyzed action references are unpinned, and one workflow has top-level write permissions; the reported low-confidence cache-poisoning finding is hygiene evidence, while the pull_request_target workflow has no untrusted checkout or script-injection sink.