whatwg-url

Lifecycle scriptscaution

A prepare script runs during installation, adding install-time behavior that consumers should account for. The signal provides no evidence that the script is unsafe, so this is only a modest hygiene concern.

Repo toolingcaution

The project uses npm scripts and esbuild, but no security-scanning tools were detected. The missing scanning is a hygiene gap, while the build tooling itself is established and explicit.

Type declarationscaution

No type declarations are published, which is a minor integration gap for consumers using TypeScript. It does not indicate abandonment or a supply-chain weakness.

Workflow auditcaution

All three workflows were analyzed, with no untrusted checkout or script-injection findings. However, all 9 action references are unpinned and two workflows grant top-level write permissions; the sole cache-poisoning finding is low confidence, so it is hygiene rather than a severe risk.