uuid

Lifecycle scriptscaution

The package declares prepack and prepare scripts. These are build or publication-related lifecycle hooks rather than evidence of a malicious install step, but they add some execution surface.

Repo toolingcaution

The project uses TypeScript, Rollup, Webpack, and npm scripts, showing an established build process; no security scanning tools were detected, which is a modest transparency gap.

Workflow auditcaution

All four workflows were analyzed, but all 10 action references are unpinned and browser.yml combines pull_request_target with an untrusted checkout. The sole cache-poisoning finding is low confidence and hygiene-level.