upath

Lifecycle scriptscaution

The package defines a prepare install lifecycle script. This is a small additional installation-time behavior to review, but the signal alone does not show that it is unsafe or unusually complex.

Repo toolingcaution

The repository uses established build tooling, including TypeScript and tsup, but reports no security-scanning tools. The missing scanning is a modest hygiene gap, not evidence of abandonment.

Security policycaution

The repository has no security policy. That reduces transparency about vulnerability reporting and response, though the active project and other release evidence partly compensate.

Workflow auditcaution

Both workflows were analyzed without failed files or dangerous sinks, and one scopes permissions at job level. However, all 4 analyzed action references are unpinned, leaving builds more exposed to upstream action changes.