walk-up-path

Lifecycle scriptscaution

The package uses a prepare lifecycle script, which adds install-time behavior and modestly increases build transparency concerns, though no other evidence indicates harmful behavior.

Release historycaution

The package has five releases since May 2020, but none in the last 12 months and the latest was in July 2024. That suggests slowing maintenance, although a small stable utility may need few releases.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, reducing evidence of current maintenance capacity. The repository is not archived, which is a limited compensating signal.

Repo toolingcaution

The repository uses TypeScript for its build, but no security scanning tools were detected. The missing scanning is a hygiene gap rather than evidence of an unsafe release.

Workflow auditcaution

All three workflows were analyzed with no reported audit findings, and none uses untrusted checkout or script injection. However, all nine action references are unpinned and one workflow grants top-level write permissions, weakening workflow reproducibility and least-privilege hygiene.